{ "Event": { "published": true, "date": "2026-07-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-29", "timestamp": 1785369781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1cd25f43-9a62-4925-a555-8f50ec50821c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8160331a-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333048, "uuid": "060b63df-76b5-4479-a862-bcd7c55e8e69", "comment": "Malware payload (Mirai)", "value": "c0fa08d4439b628599e1b2a5e454a7d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333048, "uuid": "b6fd05ff-2178-4a39-b8ea-22dc840a3e87", "comment": "Malware payload (Mirai)", "value": "00b737ebaf75e5059a7bfecc8f67d8269c82f9782bae8367f79740bbc1f23d97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333048, "uuid": "a91cca84-e5f4-4636-bc8b-07b7098df7a8", "comment": "Malware payload (Mirai)", "value": "b70b59c8051daff41c6c51742c47c247f66c0ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333048, "uuid": "5268820a-b316-4749-9ae3-f132bc0652d2", "comment": "Malware payload (Mirai)", "value": "adfa0164e52aa1a7680e60553eb09b80d0a32730e87ca95d158f2a3edd8f0aae751db41d06d702e18e1364db682b896c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333048, "uuid": "972c977a-71c5-4ef7-a4c4-3937f1216d0d", "value": "T1FD255B5AF2B370BCD167C030439FDBA2A835F47A01126E7B21C496353D66EA02B59F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333048, "uuid": "1980090f-1f23-439d-8a75-bdfc2a287eac", "value": "12288:O1cjPEY8qs5I3UDc0u3FRDzUxgEZoj8i6vqAWkkyyPl05VFExw5fG:Oe1s5I3UD+VRDzbwojL6vqmFEuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333048, "uuid": "25924bee-63a6-473b-8cc8-5c5c7ffbe08d", "value": 1023968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333048, "uuid": "412650f5-4555-4ef3-b711-7bd5d5fa9481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333048, "uuid": "31717e88-4141-4be6-8e09-529503dc7779", "value": "x86_64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4caa73f-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350395, "uuid": "37812dd2-6794-43c0-bab3-e02dedaa0327", "comment": "Malware payload (Mirai)", "value": "ecb2f9ce6a4a7c6bab568f65dacc5262", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350395, "uuid": "57f5aaea-f69e-4133-9903-befd65a94290", "comment": "Malware payload (Mirai)", "value": "00d148fd3572eb11cdc5dc7c39369ce0a8d5184549c0a8a80c0562c1c9e8b50d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350395, "uuid": "a5b36fa2-2c01-497e-b538-734b8268a921", "comment": "Malware payload (Mirai)", "value": "3a5e3d680f62771033e8179c7678a916286851b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350395, "uuid": "387ae7c1-6c19-4124-86e1-346d1da853db", "comment": "Malware payload (Mirai)", "value": "e9c7669ad4dad0c6092dc79040771809eaf87fa5f46fc7321c657bed5015e84f106b9aa7df4812a40fb83eb0e26c30e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350395, "uuid": "9d2fba05-ab2f-408a-8234-ad760b775933", "value": "T18604194F7710CF61D328C53009B3CB9666E926622AE18549F32DDE083E6434E686FFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350395, "uuid": "9d609a2b-9bc1-47ef-8d9d-0a8ce4a637fb", "value": "3072:s/TXL3lOR8+9nbEgMVGCX3AxHkDmMFhWLKuoBInyxAw6J7AXMNB3zkNra1DCjrLM:s7LL3AxHIHHmyWZJ7MAB3zKrAUrLu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350395, "uuid": "7056621e-0a3e-4c09-a77c-46a0def26542", "value": 185776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350395, "uuid": "3438b2fb-e9da-48e4-b05e-df084f66284e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350395, "uuid": "cadb8370-93ae-47e8-b854-ab851c3913a3", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845fbabd-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333053, "uuid": "63def12c-809b-4d64-b964-6c244c9aa5c1", "comment": "Malware payload (Mirai)", "value": "ec8088c16165bcfbfddf598a47e1f2a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333053, "uuid": "428bff1e-b57f-47a5-8eb9-343f7ab9c9cc", "comment": "Malware payload (Mirai)", "value": "00ede09948ea4288d12db39d0ba935e9c5221b2b38d2fa67c5db0a6dbe66eeba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333053, "uuid": "83a53dca-47fd-431e-b6a3-e2f017f5b101", "comment": "Malware payload (Mirai)", "value": "da9c78e1623615170858b937f7f8c6a8fd0eb65a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333053, "uuid": "b4a20d02-773c-499f-a5ca-c96cdb0ba42b", "comment": "Malware payload (Mirai)", "value": "ddacac5158089fcd4c0e541fa47a632bd3e90616a598bb154e6c0aa8f5a05fbfd1d75efaa744777029eaf3062748eea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333053, "uuid": "2bc98a13-4178-4d62-8046-2463b6be81ce", "value": "T17404B85A6E228F7DF268C73047B74A35975D23D627E1D684E2ACC1102F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333053, "uuid": "74d98db6-44c5-4fd0-8793-ef0e65a9ec7a", "value": "3072:t96PtSEyzFoOh+IQx4XpSTDNg8NIAKqF/azTKorgm9nbL1:t96PtSEGFFh+KXM3uSFATFrgmBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333053, "uuid": "32eaa8b9-c6fd-48f9-908a-8da6c1661fec", "value": 188948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333053, "uuid": "65e509aa-b8a9-4b39-9b0b-ff60b56ee988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333053, "uuid": "b8392cd3-bc2d-41c3-a092-79fcede188a6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9336e6eb-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305161, "uuid": "904f1e79-799d-42aa-ab28-1064d48947b4", "comment": "Malware payload", "value": "1111fae2098ccee7c4aadeaec9c97ff1", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305161, "uuid": "be7f3f3c-1c1d-4b72-8f7d-eb5e83396215", "comment": "Malware payload", "value": "0210080da6e4cf7cfee029ad1f8aaf846910fe6249bac810cd84127f3c058d19", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305161, "uuid": "ac33135f-b327-43ae-b608-07a6443f6985", "comment": "Malware payload", "value": "ffbf0171ff2725cf9c12b6b3c24699a6874b6884", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305161, "uuid": "bcfa74cc-bc19-4404-b405-c2e38aa8f87e", "comment": "Malware payload", "value": "572674256c160f8b6773ffcf1c31072873383e61524264492bf18687dfe7cf6054dfc00bc30d52824daa8fea23d04376", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305161, "uuid": "a72a4f05-0523-49e6-8be7-ac9499c807dd", "value": "T1E9B58D43BB144E31C58E8631D8BD1B50B731729E6B239B263958D9ACFCD37C187A8789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305161, "uuid": "8d8d9294-c355-43c5-a90f-e62722664e8f", "value": "49152:oB/i/RmMqEk9pxP+Ux/8d2C9krOqXUoEJ7VvZlZy:6KpmMqPpx2Ux/2hnpZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305161, "uuid": "20130cfe-2735-46a3-8686-8b540dc27f97", "value": 2434184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305161, "uuid": "7c4aa2c2-96fb-4120-97d2-0666cc9700d7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305161, "uuid": "671b5549-fc9d-427c-a90e-8be892544580", "value": "classes (4).dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800beeee-8b5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785335623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335623, "uuid": "551d6ca0-79aa-42fd-9d12-80ca73a71be4", "comment": "Malware payload (Prometei)", "value": "69c00a4781130af44bcf4923d79dde48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335623, "uuid": "f8901b18-2aba-4e7c-adf2-4c75fed79d9c", "comment": "Malware payload (Prometei)", "value": "02ab21651a7d73e8622bda72a558b3e2937a2325425feda9d97b859b9a6825a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335623, "uuid": "ed81b2ed-af50-4c73-9d88-6d7b6329b34c", "comment": "Malware payload (Prometei)", "value": "7bb8b87b325286c6e94ba423f9a4650dfc0c6dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335623, "uuid": "80a6aa8b-6572-4e14-8406-887c97367f59", "comment": "Malware payload (Prometei)", "value": "2b03cc3b0af1ef130844141cf7e2b9fe8c55ac25f8370e24bdfa3350dda449d36a1956341531a6758167d87316f42d41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335623, "uuid": "e49b7423-f327-40cd-b158-1fe4ca256009", "value": "T19CD42302BBC10AE2A60DF9E2A075FFBE425EF2D0D50995C8B25BD4D8CCA24D3F0D6591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335623, "uuid": "3c14f70b-f528-4cde-bc89-90203918abdb", "value": "12288:aD9wzV9bIQC9cc8AjQm2eXN2H55HkdkWZ84L5HRHA+etc:aD9wIQW844H5ZikW6iRbMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335623, "uuid": "bbce02a6-e128-427e-8021-a1771acb0883", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335623, "uuid": "be4fadf6-c289-4fea-b777-bb38a525cbb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335623, "uuid": "9e93e825-e816-4809-a577-0d6b249affe3", "value": "02ab21651a7d73e8622bda72a558b3e2937a2325425feda9d97b859b9a6825a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00818f84-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785333691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333691, "uuid": "41687241-64a8-4856-92a7-f0e6d8fb754e", "comment": "Malware payload (ConnectWise)", "value": "0a383df79d9a6bbc48efb5868fb14d96", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333691, "uuid": "a6ba9864-4bc6-4a37-853c-db3979149fc6", "comment": "Malware payload (ConnectWise)", "value": "03c5743f47a1fda44c176239e5db1fce92956512abeff90104c89fff4762acbd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333691, "uuid": "d6676290-983f-483a-97f9-a21fe885401c", "comment": "Malware payload (ConnectWise)", "value": "1f0d6e50c8966ba6ea8d11309e7d4ec7d066b6e6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333691, "uuid": "d7985591-720b-45bc-aae9-7ab2bbf5de50", "comment": "Malware payload (ConnectWise)", "value": "677ab3d771a8abc7f28d05a37fd8d81b13b109e4e2705550cda55b9ff39e3d06f18cd1cd8456ae8794be92d1c09834b7", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333691, "uuid": "ae78a3fd-5257-4da0-a971-112de4cffa2e", "value": "T156646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333691, "uuid": "dff0d049-763a-48d1-9c45-e21c89eb7061", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333691, "uuid": "f9a18581-8d6d-4263-8db4-0591ca003cfe", "value": "6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9l:Z1iw7gryNkSV1hy1Z1u2JLu9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333691, "uuid": "b2c85ca5-77ff-42ac-b0a1-b78090036e7b", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333691, "uuid": "b2b4bbe2-1bf7-4aed-96c1-80f5b5e24580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333691, "uuid": "af468131-9238-4412-ac5f-c24644367680", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8287825-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785354642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354642, "uuid": "f42c7a04-c64a-495b-b096-2315b10ccc62", "comment": "Malware payload (Mirai)", "value": "eadd80203a866a7eb9525e228cc46a42", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354642, "uuid": "629142ed-aa9f-4d74-90f5-a94eadec3d69", "comment": "Malware payload (Mirai)", "value": "03cba07268c420c1e208547cbb7162fa0f34176c8949fc5cb279cef06e94e90d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354642, "uuid": "87e3831e-f598-4f83-9b63-076a9eb8d260", "comment": "Malware payload (Mirai)", "value": "8393c48b171ada1b49980d29146b20911e00f3d0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354642, "uuid": "6baacce8-95e8-4b99-a5b3-ad7f3106a9dc", "comment": "Malware payload (Mirai)", "value": "50495ae6c5569ce1ad655787af1e240c78224a197b053236f809224b8b4395763d80aec8ddeb6d98a66e3c439efa5bcc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354642, "uuid": "24140c28-04e3-4d0c-b363-49f914711953", "value": "T12701ABCAE1609D00809A981D22EB9554F830C7C7254B4BA9FFACE43E9B98D14F076F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354642, "uuid": "1c2661f8-be91-4a46-bd39-03dc228d1758", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaxECwVgjCS5rF5FCrqhdCcyCJN8ZX:kXCKysE2hi0ziQvZohaxEBortdb6DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354642, "uuid": "6a83fbad-c392-4cc6-a050-6ab021b1277b", "value": 840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354642, "uuid": "f3c50bce-6e0d-4106-85e1-fd08e160402d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354642, "uuid": "34cd169b-7bdb-4da5-94d1-eef2cbf37004", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcd3028-8b59-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1785335408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335408, "uuid": "f620708f-4b00-43ca-9bab-f10e8859004f", "comment": "Malware payload (njrat)", "value": "0f74892809973a93321c7ba05bdf61ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335408, "uuid": "411c97a6-fcc5-4917-8335-3e0dd9c5737d", "comment": "Malware payload (njrat)", "value": "03d2e8ef968a70c032ffb01c98b29ab612ae48043b44e63d15c2504f7f85de13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335408, "uuid": "9c4d0a6c-cf4c-4326-9dbd-57c8ea2f7e0b", "comment": "Malware payload (njrat)", "value": "d0b31bfd1d8e40efc3b3b30c1cf9b655c9365935", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335408, "uuid": "0c75a2d3-a94b-40a3-9983-b8853c5ffcd9", "comment": "Malware payload (njrat)", "value": "1f5fb26fb70d8fc6748aa2ca955912103e01693f5c12e8050b9817419bbaf79180e91a5a1b09901d7c7d2615a9962ab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335408, "uuid": "bdd69219-1de8-43d6-a13c-af4ff506a819", "value": "T1C4E22AADFBE64465D2BD0AB50571950013B8E003E523F77E4ECB24E62B6B6D84B84DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335408, "uuid": "78eec22b-0e88-490b-9ba8-3850dbac52ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335408, "uuid": "d3d00f71-206e-48df-a09b-8fcea15a773b", "value": "768:mRCLqdzNB0zx/6LyTmvUXdvMxQmIDUu0ti6Qj:R6KbpIQVkyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335408, "uuid": "ec4eff2c-f5e6-48c3-9951-183f8e2a79f6", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335408, "uuid": "dc676e67-9a89-4d98-b9da-4d218778d024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335408, "uuid": "d288eaf5-b7af-4777-94ec-bda0d4137751", "value": "0f74892809973a93321c7ba05bdf61ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf23ea0-8b46-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327241, "uuid": "27047385-58b9-4635-b369-38ae143f3676", "comment": "Malware payload", "value": "ccd171619f39bc72ea80336320cff5f7", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327241, "uuid": "faf063ad-102c-413e-8a56-84dd3cb96c0c", "comment": "Malware payload", "value": "03d35b441b32a0acde26be40c33b708fe2d6a26290230b43aefab99191d3996d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327241, "uuid": "916cf97d-4f5f-4ad4-b6e1-a57b54e7f00c", "comment": "Malware payload", "value": "bd50e55f2ac749f2250759b641fa663b3369a3b0", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327241, "uuid": "34f7ccb4-de9b-448a-a30a-96ad7915e940", "comment": "Malware payload", "value": "ee20949e91fc59a6d563f97892bde2f81802bc3b6fa90a1f88c866c1cf28cb7b7f135251d5d9d92cb880ee320a66b177", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Capcut", "colour": "#00250B", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327241, "uuid": "a6536d84-3561-4378-97a5-e227c9484e73", "value": "T1055633C6B8CD3770C08BC7728292669E703E7FC17E3A9D5776D87A091EB16149A7A340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327241, "uuid": "b1368aa4-e44d-4c18-a616-4616b920c93c", "value": "98304:lNq4L6KU5auvV4sZM5ZaJlUFl0zsC0xP0SzuRDGB2iVQ0tM6hxWXwLaJkY/tkjkp:fqG6KeVvVpAanUD0zsC0xsSyFtKVMm0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327241, "uuid": "a9f9fb74-9898-428e-a769-8b390b4c4e14", "value": 6103040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327241, "uuid": "fbfc815a-b944-4081-a885-13accb815e66", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327241, "uuid": "cd80cc6c-cdd5-4d4a-8915-1be5675d6054", "value": "Install_28n020.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843d45a3-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351522, "uuid": "2446c4fb-661b-454f-855b-40bf3067d7f2", "comment": "Malware payload (Mirai)", "value": "32977ad9dc13bcf42319a6d16ee11628", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351522, "uuid": "5952c92e-cce6-451b-8969-67a49808c515", "comment": "Malware payload (Mirai)", "value": "03fd7be9f0167cfa5ed7aff44c310e66e20141134f4c4b51b60f7cc706a47f64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351522, "uuid": "efc84966-0d10-4e8e-8e57-e2770dfc1d62", "comment": "Malware payload (Mirai)", "value": "82033025b1f9cb01d5bd95642c4a9b05a71bb3cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351522, "uuid": "08f2a4e7-67df-4b16-a9cd-c0c64539d6f5", "comment": "Malware payload (Mirai)", "value": "65917df661f2c835ad21839ae5e32ef22c14b6585cd53392a1e18d6b2a6cae4d83718c1bcabd879894250fe5a638f2a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351522, "uuid": "f59a37fc-c926-4db3-a627-0960f5fac04c", "value": "T1D333F26BF3B5D8278A716D35C8598BC63F9B8FEEB0D5207A077341100786CB616BC985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351522, "uuid": "6c6b6076-7e39-49d0-ad87-99fc7d31548a", "value": "1536:MKZDD2KzS+VdH8JmIFoc8BLzzX+telBLrs:M4RzS+VdH8JmIFocKz7+t6BLrs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351522, "uuid": "f9081b59-32c2-4edd-87e2-1a7c3285d4cc", "value": 51436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351522, "uuid": "d97e9b25-0f59-4ada-bc9f-580b1bbf8392", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351522, "uuid": "0952f532-852e-4a91-b8b7-23c06e7dcf9f", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780279c9-8b5b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785336039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336039, "uuid": "1d97ecb1-6188-4bb7-bed5-3c5ab4abbb05", "comment": "Malware payload (Mirai)", "value": "6432b9f811f974829860664e4fe830b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336039, "uuid": "8f0d50b4-c078-488d-882d-01ee066650b1", "comment": "Malware payload (Mirai)", "value": "0425863c35329613c911915f93eb006b2c4146d8d49b540844a6c2002ffccd02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336039, "uuid": "7fdd5a8e-3056-4c76-8542-b5dbf11efe0d", "comment": "Malware payload (Mirai)", "value": "85afcc17f5ade389957025ca5119d50fb0ffdabd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336039, "uuid": "820b785a-9521-4a11-a14c-1d6201f622e2", "comment": "Malware payload (Mirai)", "value": "2e83f00a6a7918bf831b24a6e2ab55e4a7e1fa74cfd9c916cffa50ee58bdf391c430af9efef8c88dd0cfd04ace798cc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336039, "uuid": "e798a713-44b8-4953-84e8-b7ffa614e896", "value": "T141041A56F8814B15C5C612BAFA2D524A37271778E3DF7203AD106F64BBCB86B0F3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336039, "uuid": "ec783bb4-a08b-416f-a1a0-0634964b1543", "value": "3072:6vjMUVIbnR1ueB4NYtSXzxaOJtGA2mcd38zmGpOi:GjMUVIbRl4NFXFa2tGX8zmGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336039, "uuid": "8cdb9400-64ae-46cb-a5b5-f8ab2152c091", "value": 184348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336039, "uuid": "faa618dc-a317-47d3-904b-682ed32ff6d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336039, "uuid": "2d2cb9ca-0971-4aaa-ae2e-a20e2443f982", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9869e7-8b91-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785359451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359451, "uuid": "dadb8272-f155-4be6-9d6a-9c0e2f49c22e", "comment": "Malware payload (Mirai)", "value": "a78335abd6297529ad5ca8dce43042fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359451, "uuid": "92c52b68-dcc7-4854-ae83-e27306c8888a", "comment": "Malware payload (Mirai)", "value": "04a7afdf922df7e62e68cdcdec70597bcb86d2831fb50665b6989ebe850a2a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359451, "uuid": "7bae54cb-0022-4448-a476-881ca69cc8d5", "comment": "Malware payload (Mirai)", "value": "8a872d379b294fe46d23bc42128b71f78dc91a90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359451, "uuid": "5efbe34d-fe9c-43c5-b6a7-3c56d0c7edfe", "comment": "Malware payload (Mirai)", "value": "58942c7a3455830973341a6e37e599e9d12bdb2e1cc34af73f79516359a3b7890a0432e51d8f97a284378bc1e74cb2ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359451, "uuid": "fcc3a597-7c70-4ed3-bcfe-4562e60add43", "value": "T155E3BF27724F1450C89641F54AEB9F5E3B3315809EAF59EBBCAE233BDA724CD1501BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359451, "uuid": "7d12caef-1519-4a92-a6c0-d532ccc1a8c6", "value": "3072:zUGnMpA8mlhfcaj8me94y+3jZXtYs0qqfcnRDgJCTG5FMubCq:zUGnMpA8m/qWyIjBSAImUCTG5FbCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785359451, "uuid": "110ef928-b616-4f49-a6e1-0844eaea9391", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785359451, "uuid": "41c54453-6cfc-4b37-a35b-714fc6ac8e7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359451, "uuid": "0d06c09d-f838-4f80-a3cc-9839e4620547", "value": "zero.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf745b99-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352480, "uuid": "21257dd6-54fb-444c-99b6-65a816e5aac4", "comment": "Malware payload (Mirai)", "value": "a1ccc2c65745e781ce2a543abee0ebb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352480, "uuid": "f9a23978-e5e7-4b7b-af05-9da551c1a825", "comment": "Malware payload (Mirai)", "value": "05937148071e4dd0a4f0dfa9f37b0dc587fc0b16041e446673affdfe0109c98d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352480, "uuid": "3abc45aa-1179-4933-a0e6-c1de54d3f256", "comment": "Malware payload (Mirai)", "value": "3e3ba9950f0ef1eaaa1b42e7cfd73e284577a7a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352480, "uuid": "a63cff75-7f46-4020-8b4b-e13179569023", "comment": "Malware payload (Mirai)", "value": "c386967d6fbb85202ea0490d1e511bd4697def68357b7ad46ff31d0d17769e40a439777f1031d6d1e53676f7d56d33e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352480, "uuid": "fd184677-1afb-4cab-9abd-9c4c827063d7", "value": "T11B430182824C3F16D7F4157BF07F898677324974E4125A626504DB25FAA02F9BEB0ECB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352480, "uuid": "25780201-4e14-4f90-acc0-7a2759a00f71", "value": "768:bufijwnGd9fo99PC9/2xrCqS3xtVOfr06aqM7z8KBUrfl8WQW8APon/bqakAOSq3:6tGLCgs3SBHOxpM7lUrumW3hqUtKGfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352480, "uuid": "53f53c02-4954-4a53-b45b-0b4249ccf619", "value": 60256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352480, "uuid": "68d99f21-b3ad-4d66-9f75-736ab5f123b1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352480, "uuid": "5d1d842c-d759-477b-a5ae-dcd5f36fb2cd", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be777a3a-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324561, "uuid": "e38fcff1-30a5-4858-a449-e9eecc8a7f79", "comment": "Malware payload", "value": "ddabd52957147fd2880bf04de3f750e2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324561, "uuid": "e8f51505-73a2-4b1a-83d0-1e5c9e846922", "comment": "Malware payload", "value": "05960451cd9f8bf4923f125aff729b16050a0c0a251b6792292126a5037a64a1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324561, "uuid": "bd935608-6b15-4f52-9dde-11c9dc095523", "comment": "Malware payload", "value": "ebf3bbc1c5d0888ef8cbad03f8d72fd64b16eab1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324561, "uuid": "ea9db2cd-4b4e-4948-9a62-d160a956f8f9", "comment": "Malware payload", "value": "7d0e99356ec27b5785740cf12b5939e35b79e2e66c184a9431dd7ba25e9561181f288e6067e85f0f8f83c5897d8bce17", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324561, "uuid": "84c68b90-a19f-4457-b5f3-4dee104d7db9", "value": "T14521862C851E4A25D5479035A0395F3B26279839045A0EDB04C0B3672229BF44FD5C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324561, "uuid": "7eab829c-7822-4519-85a6-3013edd61a2a", "value": "24:9UuMn9RKjDBIAS5ECdetTCJuvlUivU31Sb/UbKmkNMtubjeYiNKA9MmgTnmbXB:95M0DSEqyTCJMluA/kKTaIb29MmgTKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324561, "uuid": "85d0fce2-6430-4621-bfa6-6c1dcac51948", "value": 1404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324561, "uuid": "ff37517e-7590-45af-ae96-cca316806279", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324561, "uuid": "2465700e-364e-41ad-aa1b-b0567aace611", "value": "photov_323085435055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdcc948c-8b1b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785308695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308695, "uuid": "0db30a01-d167-4d1d-95c4-32e5014c1c90", "comment": "Malware payload (RemcosRAT)", "value": "9a819f9af3f5b9bc74ddffc36fe200bc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308695, "uuid": "cb59f3b1-958e-450b-bb3b-d85434929277", "comment": "Malware payload (RemcosRAT)", "value": "05f93f2b503afa4ab697ae597cfe20e698b403a19516565f7d2277542f755e37", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308695, "uuid": "c6586769-c6ff-4e7a-af34-f9bc09b24877", "comment": "Malware payload (RemcosRAT)", "value": "c4395b2c05268c1351d4b574202238e46102f854", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308695, "uuid": "ae920193-89f8-4db6-b03f-3463f713d02d", "comment": "Malware payload (RemcosRAT)", "value": "4de4af40cd3df94de1ed07427b6b88a9a7004138a56307e4980bb800057b10fdd5f28de5206fc1ecbb0759e399c33605", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308695, "uuid": "d310c1d1-4396-4cf8-9b38-4bffca6b9c6d", "value": "T152441721DCD80B3A0E57079DFE514A65C9FDC529863390ECEA9E071E50135ACEBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308695, "uuid": "abb2901f-0cee-428e-b5b0-d5c3676898c2", "value": "6144:Fup9vbhX6B9GWsxKxNpXlBhFOaFRvZR79HY/T5:iGB9GW1Lp7HTVYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308695, "uuid": "d047f92b-1ddd-4364-a69e-0e3565588488", "value": 276637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308695, "uuid": "0c929fb9-54c4-4769-84ec-cabb7cce6081", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308695, "uuid": "97534fb7-4700-4d50-b06f-925d59de5d95", "value": "TT COPY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992b41ea-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305171, "uuid": "c32df627-c5a6-4980-a80d-606099272142", "comment": "Malware payload", "value": "8b8e3a40f5c412787db704314b57646f", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305171, "uuid": "4c217b75-ee6a-414a-9298-bd9fc61af449", "comment": "Malware payload", "value": "0619a40ade8d48b9123f0904215d520755ddf9db4f084c2e7403d550b065cb3e", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305171, "uuid": "d4a4e310-d2fe-4ce5-9068-a313420ea899", "comment": "Malware payload", "value": "326fbc925281337cdc3d583282ac948f76f704e5", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305171, "uuid": "d8363228-31e8-4235-b3bf-7428d75fc1a0", "comment": "Malware payload", "value": "9a2a4e65fc13e46aef6602b244abd01b570ff7f519b279e1d29a2e3897d90f40be2539e43e53b96840650e8cbe6e1dc7", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305171, "uuid": "54d3faff-eec4-4a2f-97d1-14b883e056a7", "value": "T105C59E03F7144D33C6CE827598F62B59633173AABA4393566854D8ACBCC33D186B86DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305171, "uuid": "d6c1f59d-1254-4ba7-bfea-7fe89713f543", "value": "24576:QAF9SP5d9qEhhmmfofmfsflgu5qiuALnrnLaG5uqnRPfR0hYMiQzc22dQw:QAF9S37hmMmMqJ5qiuALLXDyYMnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305171, "uuid": "9f592244-ab62-4969-93b1-9fc7da034836", "value": 2710436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305171, "uuid": "32d0359f-5b80-4702-a279-bc3108e38f9b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305171, "uuid": "da737058-dd81-4b10-a743-44bfdf86babb", "value": "classes (6).dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987661c0-8b26-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785313330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313330, "uuid": "281edebd-630e-4192-b6b9-1e8326b5b5ac", "comment": "Malware payload (PhantomStealer)", "value": "409290242adaacadb19b4848fab67bc6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313330, "uuid": "71bb6067-0af2-4011-9a97-e13180d249ac", "comment": "Malware payload (PhantomStealer)", "value": "06d7286fe48d9ab8724fdd4049e62d9fc525a5ce3898a9df6ca6afe27dbbd2b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313330, "uuid": "965f31d3-d42a-4427-a39c-ce9f9efdce3a", "comment": "Malware payload (PhantomStealer)", "value": "f75b873c5d64da117d69c2480615ec878367bebb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313330, "uuid": "3610766e-7490-49fd-a926-5d611a66df03", "comment": "Malware payload (PhantomStealer)", "value": "f2a8270a0583832826bcb51f170e04876bf4a270eb986c5a91bc8be2c5e89c9295e410260c6c3320c29da016795fe279", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313330, "uuid": "843f58ba-889e-4a9f-94a7-7065cb24b158", "value": "T1EF957CF35F7E3240E964CA9EDF49A81AD2CA05598D42052BF1B7BDE2DE304E224C5E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313330, "uuid": "c9520248-69be-4731-aca9-9fb9ef7fc094", "value": "96:E++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++J:ktX4bWzZcmNRd9KcxVaAaYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313330, "uuid": "cc2255d4-f39c-4d88-93d5-bee724582a39", "value": 1885840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313330, "uuid": "12fdab79-47d8-4316-a980-eb5c70227b76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313330, "uuid": "16741332-2048-4d73-92f3-63a980864123", "value": "Room_Booking.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ed1324-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333023, "uuid": "1962d1f8-9d5c-459d-866d-c2a7081a6ed7", "comment": "Malware payload", "value": "72ae8267c39a771292bafbeb70eceaac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333023, "uuid": "f3b9f5cd-9776-43d1-9d3b-fe2fda2614b8", "comment": "Malware payload", "value": "0876e2e14dacb3bc960635fafdb65f2461c1c53f818c50b88ed74e601cdbc555", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333023, "uuid": "bb89f2fc-7fdf-4256-8160-cfde3f88a786", "comment": "Malware payload", "value": "7634ee4a6c13db505b0dc2ca2d52fe07c51df71b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333023, "uuid": "2f1e3926-128e-4e72-a80c-427566115b20", "comment": "Malware payload", "value": "fc9c8b79964dde97e85b1e396499d75b7ba0fa085e58693c4a315a02c357f276604bac89f85dcd7a41a12ef14f2f9edd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333023, "uuid": "2e5d9ea7-fcd5-4b40-bff0-27bc56fec710", "value": "T1B2E32A05B70D0B57E1672DF03F3B63E493DF998028A4F680255EBA899272E322647DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333023, "uuid": "641171f2-d023-4f31-8c0f-8bec8a73d4cf", "value": "1536:uK28cLMxquUCtpIXH7oOGv9xxuHElsmqcDRUeZTEi7ovA/N9XpyWPRlhpJX7tIqw:N2tIxq1C0bEvDRpZx9/zbiJ/aNJiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333023, "uuid": "c043b56f-c08e-48b5-bc2e-267d6141b451", "value": 150620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333023, "uuid": "ca541dec-5207-44b7-b122-65ed15b26003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333023, "uuid": "091c8ba8-423f-48cc-9f4b-d0d728e85c02", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebc2c2a-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352479, "uuid": "053caa34-3b5d-45b7-a7cd-2f9a2c82cffe", "comment": "Malware payload (Mirai)", "value": "a4c2e30e7fc93f5ea420536b9e64c66f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352479, "uuid": "b109297f-6846-4914-b75b-d12832ddfe93", "comment": "Malware payload (Mirai)", "value": "08983ed95707cb36e6282d4eaa5146525d8878e9ddff22b984c8a4298607bdc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352479, "uuid": "b94815ef-0433-4f71-8cbc-9f1f1f103564", "comment": "Malware payload (Mirai)", "value": "8109f4fd5e8f499ad55e2e9572ce7e43e08918d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352479, "uuid": "46e25bb5-2d52-49fa-9388-bdef50780d34", "comment": "Malware payload (Mirai)", "value": "a26004e68ad85f7473df14a089b42336d4ef5beda5489b78f3ad1ec45242516d43474221ce7e7e49e262ae4f017f64bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352479, "uuid": "a340a0d2-01bd-44d1-a036-af7501969e4b", "value": "T178145CA9BA0F6C41F1C2D3F9DE8C83E13E1731E3C77689B1781212EDDAA39D95990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352479, "uuid": "36162439-bedb-4a03-9fef-5f9c1fc5c7e7", "value": "3072:VxSsbgDFybl+jw2tFCNniMRq1GG7SKKKRyvppRM1rnoq:VxpbgDFoluw2tFgnhY1D7SKropRonoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352479, "uuid": "f8d66a4b-3d94-4cd4-af40-08c391be7ae5", "value": 198640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352479, "uuid": "effbe136-b93c-4eb5-a8b1-9813d66603ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352479, "uuid": "1c820da8-f69b-4d3b-af9d-1e63de4a521f", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3338797-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307443, "uuid": "59cd342f-5652-4bcf-a7c2-6704e56a1b61", "comment": "Malware payload", "value": "78612cc8284462bcd1d388310a9d5d52", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307443, "uuid": "0a4485a7-79d8-4f6e-b19f-3fc7a55e3cf0", "comment": "Malware payload", "value": "08a7e7d2ca735e2e9142b50b0874cd801efa9058a6d1288b47a1f2aaff4f17cb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307443, "uuid": "eb638a66-d186-47e7-a16b-57c8bb0b90f0", "comment": "Malware payload", "value": "5c6509667f299b51eb886ed37345ec493a988cc1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307443, "uuid": "8878a54e-38b6-4f3c-a348-9e9ccb2ad015", "comment": "Malware payload", "value": "e64e26abe4a3b89a921343615133195651c94207473e3af4f333069c6652221e9663774184ad380a5a4be0178eaa6d04", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307443, "uuid": "423cfd58-de9b-4d72-a525-609cf2275fdd", "value": "T14A714D6B89CA450649D25A71E9270E8C024EF1CECE72A6A565C428DA5C4BFF1B84E18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307443, "uuid": "033c598d-89a7-4291-b448-04fc3782d285", "value": "96:/yQoA418qx84VvTLcDTOP/nCOaGlwOHSr4UhMxjojZJTMSse7:aPAYFS4Vv0DTOP/nCOPlSr4UkjuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307443, "uuid": "4cc319e4-de80-46e9-a536-0c46bbfa9b56", "value": 3683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307443, "uuid": "98227377-b1ae-4a2f-8ea8-d352fe83fb37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307443, "uuid": "c58ce7e4-cd93-4fde-845f-ab7c20af471d", "value": "images_20260728_191950.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f84b902-8b5d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785336723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336723, "uuid": "87d26fa4-7ba8-4a9f-9e94-ee77662a2348", "comment": "Malware payload", "value": "b8202320f8a8ff3c4e110e6e043bc38a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336723, "uuid": "50b700f3-dfbd-4fca-9992-2cebddf5e22a", "comment": "Malware payload", "value": "08becf1a0bd0a2ea01aab31d9678cf2b2e72372fe10aa01777c18acc9b9ffb30", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336723, "uuid": "9cf7dfb9-9cd7-4d94-8e73-58ba1aa7ec1c", "comment": "Malware payload", "value": "7a9267f2b5a743d6554458c69dd5ae697d9c44ab", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336723, "uuid": "1ad4e128-0206-4faa-9089-883d9d292d53", "comment": "Malware payload", "value": "4915aee6b946720155d101a83695c5dbb71d8bfb11aa242e3a1a7827fee5fd29d15d1f7a1c6fd6dd3f6e9faf1dc852b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336723, "uuid": "7c36cdde-1dec-46c6-b55b-c11807741e6a", "value": "T17B235C6516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF68C4A69DD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336723, "uuid": "d08a9ce2-2e65-4983-9c71-d6c7284fc128", "value": "768:k+4C9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:k+4Hcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336723, "uuid": "dac1ff6b-746c-4431-b446-a342271d2226", "value": 50047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336723, "uuid": "1d8ab215-9cff-4bc9-a1ec-f698ac8262e4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336723, "uuid": "d95c4ebd-9a01-47de-bb55-28eca8c60dd2", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d81bdd-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333029, "uuid": "44471800-104c-4de3-9e39-2c57118e2d68", "comment": "Malware payload (Mirai)", "value": "e0f0f6350fd8b37428c37344f663352e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333029, "uuid": "efcecc06-900f-49cc-ac0a-8011a3ef0c0e", "comment": "Malware payload (Mirai)", "value": "096943093f385ac0cd7af53dd2bb5afa5ec20159cb0a550060e5a1c06eaa25e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333029, "uuid": "e9b27e72-360b-44d1-9f04-b80d25d5641c", "comment": "Malware payload (Mirai)", "value": "239648fc09b5d92f8ce597fd37a01398c9fd4000", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333029, "uuid": "2fe4de5e-eb08-4dcd-99e8-90dd257ad458", "comment": "Malware payload (Mirai)", "value": "ad5c046d5639b2355026d2999e6ed8d876ac60cbae0a135ca19ee0d3cb520f1dee97cc40a829c91b337b6678fcf419c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333029, "uuid": "e30cd08a-0561-4048-9a66-f510a93c3079", "value": "T12E94237C7076B03EE6114630368B5648EF3CFF7685DE12A3E944B6A2537B18A19472CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333029, "uuid": "9aee170d-ebbc-436b-a528-793117af09d4", "value": "12288:qX9NdKSSxQO9/GbbkYwXvgCHpUhgI8JM1foV6ibfH9bZ:89bKSSTukwCJUuI8eybHlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333029, "uuid": "8047d742-4f67-41b4-bda1-c34bf3f89636", "value": 413392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333029, "uuid": "20e026b4-ea4d-4014-ba9d-4522880363ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333029, "uuid": "847bc5bc-e1eb-4e9c-b441-0b026dc1f225", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794bf790-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349785, "uuid": "6e0277da-6b44-42e6-ba62-06d8df76acc0", "comment": "Malware payload (Mirai)", "value": "50973df7ec89481c6885e2289ea03978", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349785, "uuid": "f2796165-c8f0-4255-8f13-8bd6b98048c4", "comment": "Malware payload (Mirai)", "value": "0a924a5f0ab09c5a8a07807685a4637cb54cfa9185da8a18204930727571ed5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349785, "uuid": "6e9d8496-6df9-48e7-9e88-6d2a8eda2719", "comment": "Malware payload (Mirai)", "value": "0b5ed0f0a95b74d2767ea2f7880349cc0dc0061e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349785, "uuid": "3a6842b8-d2e2-456a-9b6b-d897735fa066", "comment": "Malware payload (Mirai)", "value": "f06f25da75b4448646c3a297d46ce0a7018fd619ee8f75cc44b574c9e7489eae66d0674f8cb8124fb62c0aa34d05da1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349785, "uuid": "4ecae3c7-1048-4a21-8c8b-406b4d4a8972", "value": "T17CC34A06B5A244FDC15BC434C77FE927EB31785E13243A6E6788BA711E22E711F1AB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349785, "uuid": "43568d39-93df-4874-9958-9cc9057a9bc8", "value": "3072:Q/Jm+bz5mOG82G/bUhjUBrSpLflHH9+L5BO24Li:Cn5zGz+bCQrS9tHctBON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349785, "uuid": "9fafaeb5-a675-49a8-b203-ebcb457b5a50", "value": 128920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349785, "uuid": "78705b6e-bf1a-49fc-a43f-6826193bfc33", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349785, "uuid": "c13b76ce-1fe9-4ae8-9368-49161dd7c0c9", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8298594e-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785333050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333050, "uuid": "57e7e30a-b7bf-4704-8a62-fc880cbef67e", "comment": "Malware payload (CoinMiner)", "value": "9aaed2cf06d9fbc999b4fa4c715acca3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333050, "uuid": "22db25cf-130e-4f2f-96f0-9df3494f573a", "comment": "Malware payload (CoinMiner)", "value": "0ba4e432149c97026ed7a0eed01d46e86514dd2ad06525a98f9bd16f700177fc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333050, "uuid": "8101abfd-926b-4687-b7ad-e9bd19664269", "comment": "Malware payload (CoinMiner)", "value": "df93cec3714d03720a371fe9e16060f337f15528", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333050, "uuid": "5b6c7b97-c96d-4393-a34e-8a84159515ff", "comment": "Malware payload (CoinMiner)", "value": "d5d894fe503976e4e2dfcc961e55d9491b66e8c65f8ebb9f0a571d97ec1bef810eb3a32af56c5d5d61b800f0f46ec0fd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333050, "uuid": "608b5938-6af5-4351-8c54-88d9986026be", "value": "T1402612E725C11ADDC526C1FA8E02BBBF979FB136CA16D683622C2121EC73D463E55E04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333050, "uuid": "dbad743f-8410-4e84-84c3-cb90b2b54e32", "value": "98304:pzPQ8irblgiQq4fpPGrL9cOK8iVGK9w8LL3eqyoFOs8:pzbWBQq4h+r5KtRXOs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333050, "uuid": "2971c3f9-f341-453a-a63f-3e99eddc1e09", "value": 4663880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333050, "uuid": "0fed045d-4f7d-4a49-8a0a-97c2b1068f4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333050, "uuid": "3457e7cf-164d-4b85-b638-15269a2aa735", "value": "syscon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7c5b86-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785349848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349848, "uuid": "6498fd46-602c-431c-b3b8-414258c8831f", "comment": "Malware payload", "value": "73b31d89a353e9c4f0ca6979d2e7f043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349848, "uuid": "55e19dc9-5916-4849-8de8-c62f68a92257", "comment": "Malware payload", "value": "0ba5c04325f7af25a2f6bf4c588dff798d481b0a799b10faac9d4daed7c09c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349848, "uuid": "200400d3-65b3-43ff-b21a-b3b45c87308a", "comment": "Malware payload", "value": "57d1ad53e3d283f3d15ca17e786a447f59104ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349848, "uuid": "9248b778-498c-4b61-8874-d8286c4b1838", "comment": "Malware payload", "value": "efb30d2c7e45b90bc21a98007d1c7da93a95ce1c37b8d1f034d8c7c88e24b1902e61a9fa86ff437c54e71c543fc75c1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349848, "uuid": "00155420-7205-4701-8ad2-e750789da1d7", "value": "T10EC1B691A3E8573AEAA74B369CBA67001635EB418C57CB6D1888630B7D37B100873E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349848, "uuid": "bbecd341-11c9-486c-9add-daff7ad934e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349848, "uuid": "e6207381-720c-4e8d-a299-a524e8f13490", "value": "48:64maksudFlAWXXenldPpB1jkQ92INM+y+WZrE6BWtSMbJv55bXfci0q/7+54tM4M:SFaeXenP1gQszHBEtdXXktmlzrr3zNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349848, "uuid": "d83c9be3-fdfe-41a6-9926-849d9e4ae9bb", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349848, "uuid": "efccd25b-d194-46d5-b880-cea57fcc53f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349848, "uuid": "30826dfd-0787-4a08-9351-1585ac31eadc", "value": "fifaconfig.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a7b65f-8b37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320736, "uuid": "589f2c25-d1c5-4b9e-9cda-a323a2420f09", "comment": "Malware payload (Stealc)", "value": "740898b58e04118c41b698eea2c74e52", "object_relation": "md5", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320736, "uuid": "a5568f69-0ef4-4a79-91f5-b9c8c877f0b7", "comment": "Malware payload (Stealc)", "value": "0c16963f43604246e81f006d1f7df0a7258b36b929252c1502d92fea573d86aa", "object_relation": "sha256", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320736, "uuid": "96658a23-3b6a-4e31-8d69-cc5faa6fbd95", "comment": "Malware payload (Stealc)", "value": "add10d5a77f0de905a2f3aa9a9b53282ff3c6d0e", "object_relation": "sha1", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320736, "uuid": "4f5abe3f-7a6b-45cb-9a9d-f0ef07bed31a", "comment": "Malware payload (Stealc)", "value": "a983dab6136684efa9782c657e553a613fb0d3d7f040790e336d47a2443a73b06a4de483a9756e181d059448179105f5", "object_relation": "sha3-384", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320736, "uuid": "6109a1c5-24fa-4f24-858e-41385bbc7188", "value": "T194F49D1AF7A502FCD07BC175CA524952EB72B8565330A78F03E14AA61F376A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320736, "uuid": "751b66e7-2296-460e-af9e-dab177c6d3cf", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320736, "uuid": "a9797009-d958-4c0e-b359-ff9169b8a8f5", "value": "12288:9CHSXamiqz8TbhvbTOMfJr6EmMoGyxBlDetAqxSvSc:FakzIbhvbCCJ+pMoGybq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320736, "uuid": "dcd6727f-4bc5-4ab3-afcf-c54e5a926026", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320736, "uuid": "42050480-2be0-4868-a0d1-1e6e9c896541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320736, "uuid": "7428e738-c961-4089-bb67-f25f4d113803", "value": "0c16963f43604246e81f006d1f7df0a7258b36b929252c1502d92fea573d86aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e193a3-8b8a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785356227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356227, "uuid": "b93fb15a-84ad-4c15-b185-e0fe2d818cd3", "comment": "Malware payload (Mirai)", "value": "cdc88b642ec443885a8bdf5807e4f6e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356227, "uuid": "1f96ef54-888d-464a-87ed-166509f1ea42", "comment": "Malware payload (Mirai)", "value": "0c3424f930bd6ac00091ef6a6f96cf4f88f830c85b8937dd1776154202048434", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356227, "uuid": "bf72026a-55fb-458c-a56a-8d1c9357fbda", "comment": "Malware payload (Mirai)", "value": "610c426218084a4174a243434ec8c152ed1f6fc0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356227, "uuid": "69165fac-2916-4643-86b5-80f10bd57ac2", "comment": "Malware payload (Mirai)", "value": "105cd24e65eb3832aaf50155f13042d76ea683b2b49de71557ccc42cdca5a212a4206ca31623d6e292a9c32047da9a74", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356227, "uuid": "ca4a7c81-93ca-4563-a669-2fc3eadbc430", "value": "T169316ACB00605A795303DADE7372361DB00C89FB289FDBA4DC080EAD96995CC72A5F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356227, "uuid": "69a17e35-a79a-453f-a03d-45503ff7697a", "value": "24:JNJ6i/h3EtjHYi+DSPQIPDjiQWiT1zNaN839hIE7L9:JNJ6i/h3EtjT+DSPL6c1zNaNGHtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785356227, "uuid": "56c7fb36-c2f5-4c1a-9988-2605dfb1013a", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785356227, "uuid": "55091523-5321-467e-9eb0-59a6fee97dc1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356227, "uuid": "0a7838d0-e83b-4709-9207-bed8d4656462", "value": "0c3424f930bd6ac00091ef6a6f96cf4f88f830c85b8937dd1776154202048434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e467b72-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785350518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350518, "uuid": "c7baea9e-1251-407f-80f4-53d5ffc4164d", "comment": "Malware payload", "value": "10adfe2733224ff1666f317012ebe500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350518, "uuid": "52b6b2e9-04de-43cc-8699-52e2b222b445", "comment": "Malware payload", "value": "0c6c43f41201dbce3472988c9c16232f1540de43e336f73d3db4cae9242c7568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350518, "uuid": "8936dacf-5921-4912-b3cc-2aebe452beb5", "comment": "Malware payload", "value": "dd01813c6a8edbd4229a72f8cd05cc2d63a46751", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350518, "uuid": "760646fa-bc9d-4664-90c8-b55faa3826d9", "comment": "Malware payload", "value": "0de2c9c59ee48748d631bcd516ee595b0c7fde7709853377d60fecfa1d1f9e3cd43166346a96bade6cd7a85e643c8b0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350518, "uuid": "9a294896-068d-401f-9714-dc7640aa57e2", "value": "T154F317C7F900E9BAF80AE3374853080AB130B7A114825A777257357FED7E199157BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350518, "uuid": "e7bc709a-67a4-4ac6-8dea-ed942206a43c", "value": "3072:h37EfPXVsd+lC3LAvr4iu8Iy0HorIkJr1+reczkSNKoAVljbiYLvnX9jW2:h37EnXRlBv0CIy0IrIkJrorwMKo+LvXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350518, "uuid": "b2646432-6fda-4ca5-b21a-bb990e9cd848", "value": 167608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350518, "uuid": "5547979a-975a-4e09-b9af-4cd8b4f7f76e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350518, "uuid": "d466d825-6d83-4ca0-a6d2-c6d622038855", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e80dd8-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349783, "uuid": "56eec6e5-021f-45f9-904b-77957258acbd", "comment": "Malware payload (Mirai)", "value": "760cfb5ef13d16dd961b8e958a244bd0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349783, "uuid": "8c103b8f-67d6-424e-9e65-452dc26d9280", "comment": "Malware payload (Mirai)", "value": "0cd19bbf6f9d4c7957914232797342030258b008554e7f88d03d55d71086ab05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349783, "uuid": "51737208-45e2-4fb3-af01-6da0f266596d", "comment": "Malware payload (Mirai)", "value": "239082d36b348b575446d413a2b252225148a80b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349783, "uuid": "457bfc54-c3b0-43ac-9ce4-fdaf0721543b", "comment": "Malware payload (Mirai)", "value": "a024d796f4c57f3d3f97c8f2dad9336882349f0f7ccfb8f3e41ebb560d15cd0fdaabdf2d1500b3fdca1aaf6280995e5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349783, "uuid": "0280090f-2743-46a6-9cd3-6ad483f67434", "value": "T1DA044C497E646AFBC06FCE70052A831711DDA44FA3F1B77DA278CC4C799A20859F3998", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349783, "uuid": "133fbd07-bfe7-4cfc-9269-54c429296747", "value": "3072:1KBISpg0CckxXdcodT3fWSG05RfX/EI7lxbijU235X+1DRV:cIcCckxX6aTuSG0Ln7lxbij/X8FV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349783, "uuid": "9c303838-7ed1-4745-8cb4-a8abe9a888b8", "value": 185808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349783, "uuid": "2a7c99f9-07a3-48f2-b756-072d4eafb824", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349783, "uuid": "3384dc0b-cf3e-4c96-ba38-681a93657e36", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaadce85-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307348, "uuid": "360c949a-2eb3-4efd-9dea-87f3545c6e93", "comment": "Malware payload", "value": "a1faa37f13f36d1fbb241ad30725d9da", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307348, "uuid": "e352a6a7-4543-43cb-8880-13bd81bae897", "comment": "Malware payload", "value": "0d6d32b2faf12c2c089c5d4a6f6b26e44e914e4f34b6f1efeedeab89310aba6b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307348, "uuid": "65e6a0e2-4927-40b5-a520-e0fe569a155c", "comment": "Malware payload", "value": "f1157e6c4ed1b12a3aa5b4d2e72a2df5f93b07d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307348, "uuid": "fe96f9e2-7f5b-4020-99c5-221575dc92d3", "comment": "Malware payload", "value": "4345f13a4ff8b6f85c7b50f7e4439f2184ce7c99ce3b877e6d7c4c0f9181b0da8d9ff09a43aa8188c3152f986379632e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307348, "uuid": "41dcd3af-f83b-4a1d-8b35-dd2dd50b9f46", "value": "T19B02AF11CE2B2A84DDA33EE1D8C1EA84650F4F7C36B7164ED0402A61C4ECAAFC15C658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307348, "uuid": "01bb8cb1-7e47-4101-8df5-30f43cc98aac", "value": "192:sp1dbz4/PMpcOEK3l1qg1r2+d2EYV7BuxWQBaBzzIn:cbz8MmKV4p+dc7UW1FIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307348, "uuid": "dc85757f-90db-4d7d-95ed-840c9803bc89", "value": 8810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307348, "uuid": "2a3831e3-8336-4a6c-bc77-fc1611f8b792", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307348, "uuid": "5eec2512-cd9c-49d8-820f-aa270e66bd9f", "value": "images_20260728_105444.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742259c7-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785311551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311551, "uuid": "29b3cb54-557d-43dd-a32a-a5eae0998c6e", "comment": "Malware payload (Efimer)", "value": "d1b65025b888852b4be429a658e92945", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311551, "uuid": "ba198c25-f9c9-477c-a9ec-aafafa851ace", "comment": "Malware payload (Efimer)", "value": "0d925c5400e17a96f4137f8cfc31fbd3890e96dddf178ce96d16388fe5b867a7", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311551, "uuid": "7fa9874c-bc93-467f-81a7-135d607b31ac", "comment": "Malware payload (Efimer)", "value": "506e88ae9340c729526c67b014e338095b4fe2ef", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311551, "uuid": "59efeb2a-3236-4468-8085-277c54f32b16", "comment": "Malware payload (Efimer)", "value": "beb8f7bde431debe829a631ee92708dcbf3a29949acf130fc2a027ecd4787633a4d6e99ec6d6278d3bde7c0dbe29193d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311551, "uuid": "26baedf3-a727-455d-9506-d47dce59c019", "value": "T15EE63328E9D061FDE973813CEFA05096F9E874769B70C5EF47A983A1AD03190DD3A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311551, "uuid": "6a650e8f-c97b-4a49-9c23-ca6c41664c13", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311551, "uuid": "07d2908d-ea00-49af-b15c-b430acb74455", "value": "393216:KoAmLgmfUQwNMFrSj6xvX+BlZXMCHWUjX+cuI3/PGTAI:K2LgCUQMM/ONXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311551, "uuid": "0a689923-9c01-44df-9905-1153c4a56886", "value": 14299062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311551, "uuid": "7fcc6aee-18e6-4218-8d7b-5182c4f86b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311551, "uuid": "9081664c-52ca-4187-a9a6-d50834bfc808", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7494a167-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324437, "uuid": "53519b83-657e-4360-8db4-12037d8acc22", "comment": "Malware payload", "value": "bd762b95aa65ac1c2b4f38cfce174c1d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324437, "uuid": "f8941f53-2265-4634-b4cb-83295c959bb4", "comment": "Malware payload", "value": "0e0528d4d1c7d1d8377a708f56f3aee3946d136512d152207e343344001c8365", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324437, "uuid": "87d9827d-a556-494f-925b-5fdddf68ed26", "comment": "Malware payload", "value": "c7e2152b0cddcb1f60d0218c6ce67c69cc27bd4c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324437, "uuid": "fcef0008-1db1-484b-9f98-9066eb5d58c3", "comment": "Malware payload", "value": "8e643bf4490e502b5f083ed0b415042e7135a787671b034f5b6286e417dd2189696cd32f425f8aaa2a56005868cf527e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324437, "uuid": "80feac88-73ef-4033-a77e-b95ff4d87698", "value": "T1E221C89CD03CCC47D4D829B77DE6BB141F3AE221A40E02EA062D588C4F91CA64B213A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324437, "uuid": "9f7effad-0745-49f2-b265-66cd7310e5d6", "value": "24:9slcbR8OAQnwz/NLHT3MUvYiTBsibrMW7QomkLn/5cpeYut6diYlq2X/:9sAKOBSVLHzMUvYiT9goT1cpeYurY9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324437, "uuid": "95f72073-70f8-4c03-b7dd-af2a4aebb6e7", "value": 1346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324437, "uuid": "760b4b9b-430d-4328-9fd2-4055770e170a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324437, "uuid": "25d65def-f6a6-4d5a-8611-ce3247b2f6df", "value": "photov_070766354893.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b62d582-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323885, "uuid": "12bb7385-d05d-4136-a7b1-8307dbd5e3f8", "comment": "Malware payload (Mirai)", "value": "96cf54958f2a2755a17bc7739d538f34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323885, "uuid": "66335c9b-e46b-4f22-80b6-937ea168fcbc", "comment": "Malware payload (Mirai)", "value": "0e50f54b54e3e179fb5530db13375a7a6bc297438511d374c680f32834934aa3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323885, "uuid": "58c02ec9-0a37-4f42-9737-71e50d707400", "comment": "Malware payload (Mirai)", "value": "6f72f214fbb4e14452014c0772143ca07def21c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323885, "uuid": "22d1dcf1-d0bb-480f-bbe6-1d8e9dbff5d9", "comment": "Malware payload (Mirai)", "value": "94db5895fb013e8d1b24f1d9e570f0be830032b8c0968d7d128e8f25c604ac28eefbcf7a8bc2b1743f0eb923ee2311a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323885, "uuid": "14ee5105-b218-44f6-a6c0-5c58199dde1e", "value": "T170F35D86EA408A13C4C61777FAAF014D3322E759E3DB73068D185FB43F86A5E4E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323885, "uuid": "03c47d44-a8bb-45b0-b798-a2de803dd855", "value": "3072:AgjZZu+bVzHprqHh3bsLOYq5IndIFrwGy/p4FugofWOVM/9aQIhAr:Dru+bVzNqHlvrFrwGy/OFyfWkM/9aVhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323885, "uuid": "59568c4f-fa2a-479e-86b0-af0e95dcd079", "value": 163542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323885, "uuid": "87dc2b5d-1e2d-4361-be1d-9ec60610b763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323885, "uuid": "868694be-d312-49df-8631-52efdefab88d", "value": "MMaaRRiiOisecTanee.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eab6794-8b04-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785298550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785298550, "uuid": "bb7c9202-2bf0-4d5d-82f9-ed36a64a23e2", "comment": "Malware payload", "value": "e59d5c71e7a7e2fe1ef698bb715b78d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785298550, "uuid": "5fcb4d40-3dbc-496c-b774-a0f8daaf4010", "comment": "Malware payload", "value": "0eb86f9973e6be36c1a192201bae9afa2ac94c576082310701c70784fae4481b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785298550, "uuid": "8eeb7178-7554-420d-8fa9-879652dcbd96", "comment": "Malware payload", "value": "ae40fb5749f544faea62b51fc849fc553089af0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785298550, "uuid": "64b9bc65-e8ba-4d54-8b38-768d41e75f7c", "comment": "Malware payload", "value": "5decca6f44211af43f15feb426679004111a7d1152084f2cd9a6942b47882df746712be3c35d61cecaebf40db421ac9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785298550, "uuid": "39d2760c-828c-485f-b2f2-08ace11e5eb8", "value": "T15F43072D53B60BB3CD76CA70C9F7433BE1A47601A5B5222F0769D9283FE3125B818D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785298550, "uuid": "9dc99100-52e1-41b5-ab87-683712594a8b", "value": "1536:aIBXt74SigUX0RAcbntBwPR/soR2ZW2m212AKTk48Bs:D14SJUlcbgR/so0qJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785298550, "uuid": "2fdbdd48-4ef4-47e2-b269-1bf1269517c2", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785298550, "uuid": "96161590-0ab4-4d13-a1b7-867e78dca324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785298550, "uuid": "82248a0a-0205-4e72-b85d-8740e63b9c1a", "value": "0eb86f9973e6be36c1a192201bae9afa2ac94c576082310701c70784fae4481b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2d3961-8b19-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785307839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307839, "uuid": "0ce2f7cc-3a83-4b51-8cc8-9beb184196e4", "comment": "Malware payload (Phorpiex)", "value": "7cb95ab547a332e56c8945838b58c2eb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307839, "uuid": "ad0c08f9-f76b-460c-ab87-9c543e128d97", "comment": "Malware payload (Phorpiex)", "value": "0ecc8ca00c5f331e2bb732b2295c8e019592d333c2ae0270653bc2900384a700", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307839, "uuid": "616e40b5-92d8-4557-9248-ae373aedc634", "comment": "Malware payload (Phorpiex)", "value": "8c27791f148b5bab5b74b0b3082da92242019597", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307839, "uuid": "e6932bc6-6479-43be-84fe-ac42e8f183ee", "comment": "Malware payload (Phorpiex)", "value": "3a3e7acb235f2dd715376807e1aa40f033f10c74142a2922b9b6dd54f737581769b01a7a534c555947ef58beaa26c38c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307839, "uuid": "8c55c1c1-b090-4cf4-bbf0-07c47b87df74", "value": "T1D5823B0FB8424216E1D110B4967596BFD9B99C7633C418EBFBD44AEE0A686D5FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307839, "uuid": "b2597cc6-236b-4ad5-b344-088b373420dd", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307839, "uuid": "08df3640-01ac-4c39-ab26-ba043f81496a", "value": "192:AWU6SkQzngjoWLsmBDTlIUqRQsPcleSMv9fKUSiu9zwfge+VOgbOOqmEd6FQv9Pb:A7ZbmsmBTsU0Vu94gXTPuav8U9c+P4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307839, "uuid": "861e8472-9098-4473-89cc-ea38ed36ff5b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307839, "uuid": "408f6dd8-25b5-4737-b2ea-218185eb2d14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307839, "uuid": "8f95a333-86e6-4ef6-a94f-bd6d006c364f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bdf9bf-8b94-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785360589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360589, "uuid": "f291d3fc-112a-408f-aef7-df17e1965601", "comment": "Malware payload", "value": "003637951e466ba67a0adad1615c942f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL Bank", "colour": "#139952", "exportable": true, "hide_tag": false }, { "name": "RBL Credit Card", "colour": "#2DC5E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360589, "uuid": "0d3c812b-65d7-40e9-8a6a-2deb176acf8b", "comment": "Malware payload", "value": "0ed2bdca1aba5f0aa9b460314668ee74511d57e54adecb06a5595aa227db6a30", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL Bank", "colour": "#139952", "exportable": true, "hide_tag": false }, { "name": "RBL Credit Card", "colour": "#2DC5E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360589, "uuid": "a3e3e407-c1bd-4917-91cb-f4eadff4d9ea", "comment": "Malware payload", "value": "e3bcc72e16c253902e597b5370642a4bd001f495", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL Bank", "colour": "#139952", "exportable": true, "hide_tag": false }, { "name": "RBL Credit Card", "colour": "#2DC5E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360589, "uuid": "1158c018-5d0a-4bd6-a5e2-060ee6ff1c25", "comment": "Malware payload", "value": "1575e913ed7cddd3276aaf984f0187a875cab8c3d2f310ea1ef3188aae45c8f81512fd750b8c757ef884d57bdb5c8506", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RBL Bank", "colour": "#139952", "exportable": true, "hide_tag": false }, { "name": "RBL Credit Card", "colour": "#2DC5E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360589, "uuid": "2f62f7c6-26ff-478b-92db-4c19013405fc", "value": "T1C306F1A47796A91ECC3B50320A255375124BEC228FE2E7576435339EEC379D84F4AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360589, "uuid": "fc214bb8-3967-41a0-99bd-af639932d5d9", "value": "98304:YXmtO7OrdLQnsGU8YVENInPCPUF2/95AQCx3:YTKxcnsdvoIPD2/9g3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785360589, "uuid": "a7c581f2-0146-477b-84c8-4ef92c8a60f9", "value": 3951052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785360589, "uuid": "43963e83-5a76-4e78-b670-c696d47a2b49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360589, "uuid": "71c25740-9069-44db-8482-5151d5e44ed5", "value": "RBL-Credit-Card-1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e51f1f7-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333043, "uuid": "f1f43828-207c-48cd-b02e-06b6d600e9ac", "comment": "Malware payload", "value": "99636969ce8f6a6dd27d26b0ba66e67f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333043, "uuid": "cf4f71e8-e0df-4c69-89f7-c7ba014a3f0f", "comment": "Malware payload", "value": "0f1d3f611d0b45b0e413159f8dd3f11fb4c45b0030a937302efdcc10fa762a0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333043, "uuid": "85ea5f47-f313-4d8f-bfd6-c14c91ad97ef", "comment": "Malware payload", "value": "9da0bd13f93f9159eb8864c11114b05d54e336d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333043, "uuid": "dacba79b-bc63-499c-8144-f096a45526b0", "comment": "Malware payload", "value": "d3a21e6ef0b29cbfa2a97bfcc5c64df7d15e1972422fcee17074e19f90b30ff8ab6b45d8c57df43c0564cbff9f8c4710", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333043, "uuid": "2414e5a0-e377-436c-8210-1463cb3d39cb", "value": "T113F319C7F900E9B6F80AE3374853080AB130B7A114825E776257357FED7E199197BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333043, "uuid": "b9d15a84-527f-4675-a50c-ee8bd6d7068a", "value": "3072:doRhivQPLdtFAtG+iR8cyd9D3Jxa7ibnFeTE7kXGTEVljbiiLRXYcpX+m:ShivKgLrcydR3Jxa7enbgXG0LRIU+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333043, "uuid": "41c0bc26-8a78-412f-befb-eed0a1a0abfd", "value": 167640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333043, "uuid": "4b1c8154-b8e8-42b1-afbd-e5a73288f102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333043, "uuid": "d9ff3900-c906-4d5b-b225-02793aa37cd1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f775c8a0-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351715, "uuid": "5e5e2fae-91ce-4781-a208-88f4b9817fe7", "comment": "Malware payload (Mirai)", "value": "6159f6402c855bbe524e1fd5b003de86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351715, "uuid": "3533e799-c8fb-4279-8f80-33ddbb3707ca", "comment": "Malware payload (Mirai)", "value": "0f46b89689bf2d3cbcebff2f1f6986d0591f91f2e06b710a2b2aba771d50f21d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351715, "uuid": "95a76553-510a-421e-8dd6-418e2cbfef98", "comment": "Malware payload (Mirai)", "value": "4503a8eff0ac5b2d428888b80b015269639259f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351715, "uuid": "4d105a73-51d2-44b3-b8e1-c4627ef842ce", "comment": "Malware payload (Mirai)", "value": "06cc427c1499afb937855df9524a51fd6c285bf79dfb004a41777bb47bf234f1e46bf3fe996a647518d6ad68fa43f86e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351715, "uuid": "44e8c9eb-9880-4fe7-8760-0b8382a79aed", "value": "T199F32C86BC808B13C6E151B7FB4E528E372603E8D3EAB1079D196F25379B8970E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351715, "uuid": "d0957f11-7933-42bd-bf9a-6ecf0e394647", "value": "3072:L5jfYfjX1W0J62Bl4nK4wRdZ3Sxmvi8qUtB:Ldft0JjX4K4wHZ3SxmSUtB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351715, "uuid": "dcd00167-90f1-4182-b177-793e8206b27f", "value": 169248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351715, "uuid": "e2e986f5-35c0-4076-a507-6645faa6ad17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351715, "uuid": "9a1f261d-985d-4f25-bedf-3fcff8e02331", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05d47c4-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333154, "uuid": "446f55cc-86dc-4667-9225-2e8f0b6d75c2", "comment": "Malware payload", "value": "06206cce3fb4f4ef39e90655cd084aa2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333154, "uuid": "37997bc9-99c8-4c87-8645-e317d3321def", "comment": "Malware payload", "value": "0f8a77a1bfb5cbe0d877aa0db048cd0dbb9892b50110930d4d13e738c8953bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333154, "uuid": "f2238d6f-f67e-4d91-9e88-df652ff60db4", "comment": "Malware payload", "value": "bc75b45b685ed5428c744ec15e4ad746925ed8d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333154, "uuid": "779fcacc-a86e-4728-b1a0-99004de0e64f", "comment": "Malware payload", "value": "4015d571987b92434c40049063e65a0a5e0537efdff33207b0c086989a096db4639c1f321e33cb0e5b16b888d14eb088", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333154, "uuid": "5b41b6d2-c250-44a7-84ff-fec8a2cfd658", "value": "T11C235C62C6B95D42CEE07A7A03F703E3C1CA8B144394CA4FED956FA59F477108C66A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333154, "uuid": "ef16a578-4ca9-48b3-b215-a7f3d75b7e0f", "value": "768:VWHr9HH4nnnFWV93WAkr9HH4nnnII9RQf2EL+7O2ocU4+DB0iJOiwzQsD2B3NUto:VWHr9n4nFW3G3r9n4nX9Sf2x7O2oQ+DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333154, "uuid": "4c178282-25cb-42f9-96a1-c34b509f403d", "value": 46972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333154, "uuid": "dda4fdca-d9e1-40ea-92fa-4934e94f4bba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333154, "uuid": "79b6d21e-e0a1-407c-a07c-c98b5e503594", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b799787-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333039, "uuid": "6b98c5e1-145a-4fb0-9755-3373dea7d7a3", "comment": "Malware payload (Mirai)", "value": "deeae64dd7ca6aa33e83bea470e495d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333039, "uuid": "a1224f3d-6590-4aa0-b2b6-5c248c8903c3", "comment": "Malware payload (Mirai)", "value": "0fb42b068534eb011b661f5a8628e7bef6be8716748f0214585dda90032e389d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333039, "uuid": "c2ec04d8-bb80-4ccf-99aa-cbb39350cd6a", "comment": "Malware payload (Mirai)", "value": "c0d9486496e791e9ba0eff81bb0fa3b747f78d33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333039, "uuid": "4ef2ef6f-78dc-426b-ad7e-e459bf6c21c8", "comment": "Malware payload (Mirai)", "value": "7f7e96321f1413d57037347b2627a5c9f3f4028169e6ee232797adf83f37987901d8047254827326835da916884e4af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333039, "uuid": "227ed436-92e5-49d3-8ffc-4978b5e3060c", "value": "T17FD31945FD419F17CAC265B7FF4E438D772A1768D2EE720399266F20378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333039, "uuid": "4aa16730-92f9-4c3c-96bd-abd1e0c26fe3", "value": "3072:3FV3NdL5+dv0MM2mAw4nnslHoF8+M1/xNiJN:37TcpNM2ZwAns1oOj1/HiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333039, "uuid": "35944309-6d74-4bdd-9e2f-c63ee1c4bd1b", "value": 137784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333039, "uuid": "f516ffda-8f3d-489d-9ca8-143834e2cbf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333039, "uuid": "98dfaa05-5b86-4be1-91df-1bf3c4488dc9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c79250-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307177, "uuid": "35e46ed7-4ebf-4e11-8ce8-e30147f59e1f", "comment": "Malware payload", "value": "bebcaffe3f5c87985bb5f0da5a74c5ef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307177, "uuid": "383bcdc8-c74b-4e20-a303-f8788906cf1f", "comment": "Malware payload", "value": "11c44a5af0e4d97f157d39e9a893263ef2758435aec9d7cbf3d2d64ae8dc4ea8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307177, "uuid": "0c7164a1-c746-481c-b126-e852fd1198ca", "comment": "Malware payload", "value": "62baee4f85409ba2b76296508b529b2a81d8b769", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307177, "uuid": "9bcb51f2-e437-4f13-8407-758a18d1e401", "comment": "Malware payload", "value": "61af50208a1537852bc1200499e9a15ad48715b1dd4d43a37ac62232557455b3ca614bc76d317b1c7eb9a8850155ec1c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307177, "uuid": "26909c08-12d4-487d-9399-77ecf4419100", "value": "T1FB72D057E1390707D63629A4268510C880E7846F09EFED273BB0CD9FF81D066FF6254A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307177, "uuid": "40f1ac65-2990-4827-9aea-5ca940ca3fa8", "value": "384:UPd2WHdIuaFsFPDXvii20txyFLcl0doZ5TJhuxyqc4Hqb5enmV03W3Eshw8:UVzaozx22xyFLo5lh94Kb5eEu23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307177, "uuid": "4a5e5735-50cb-4e5c-bfe6-fb479325c54e", "value": 16592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307177, "uuid": "8fcb5cfd-a4d0-4260-9c89-93d65fb257b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307177, "uuid": "4a02eb3e-96e3-49c7-abba-ebbd9b9c1355", "value": "images_20260728_191928.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a27544-8b26-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785313409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313409, "uuid": "e0b1b21c-3d81-483a-8ef7-63c6b57858b9", "comment": "Malware payload (Formbook)", "value": "c269b570c5c359ab50c4cebe0d4ed7dd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313409, "uuid": "bed23e12-b572-4fa9-a62f-4469c656fa7e", "comment": "Malware payload (Formbook)", "value": "120d7d50ebb847824e9d75f3f43be30a946ead142bfbd7c434e5a87affc2b2ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313409, "uuid": "650c9811-1442-4b58-ba3d-79430b50e520", "comment": "Malware payload (Formbook)", "value": "7324461113279398bfdb18472ba057e2983d62d5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313409, "uuid": "7b947ff5-89ae-4374-9099-b590457c2150", "comment": "Malware payload (Formbook)", "value": "cb5c7dbc8203f36b85d4fa2fd74bdd825a3e381d12c2d784f8b0d3e9546ae59dfd74b1f1138038981730006a20d34ae6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313409, "uuid": "0c57f687-6402-489b-add2-cf9ff8579d36", "value": "T19FA57CB66B5D311A7BB08BC329281870B724FD9EDC42A1EF603199C235D3EC96176C67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313409, "uuid": "30bf755c-6939-406f-8bce-03ec4be425f7", "value": "384:wo5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5o5T:INI5+mco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313409, "uuid": "8f624856-9b92-49cc-be09-f3314634baf1", "value": 2085854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313409, "uuid": "b212c6f8-458d-4908-917e-c842da61755a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313409, "uuid": "c1b3f501-5a96-43e6-b218-7e8fbf7356ab", "value": "Invoice (1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243ac5f9-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323873, "uuid": "c73a615c-f695-4a78-a260-eb4ec24c420a", "comment": "Malware payload (Mirai)", "value": "76d123ab88ae42afc32b5310c226e784", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323873, "uuid": "9dc04e50-0b63-4fc0-b9cf-74fb1a651d0d", "comment": "Malware payload (Mirai)", "value": "1338657109a743ffc7fd9ea023c161a7dfd55b44a987c102019a5e3fea6b9e46", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323873, "uuid": "90c17ebe-f8a2-4ff6-904f-66ddcc586f12", "comment": "Malware payload (Mirai)", "value": "d8b9b9fc2eaabf11aa2a56425fbde344ea048356", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323873, "uuid": "ea38f666-60e1-4925-ad80-444987008a84", "comment": "Malware payload (Mirai)", "value": "67c500f9bc6d70eed56294ae3432d64a0386b5da073d284f08bcdf07fc8d12013e183d7954cbf76559c7819703410d30", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323873, "uuid": "08b7c141-2363-463b-8e43-f7eaed1d62a1", "value": "T129314EC62B875AE93F2C6E127949CB1C63494DDDA8017BC8A5CFC8B06EC0AD6BD05A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323873, "uuid": "fc92e67a-2e58-4ec8-953d-81d2f2ea2a2a", "value": "24:w6QFQdNIdQBKEQIvQjQbAQJQXlQ4Q9gQPHR:90/WBx2qAa2l39wx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323873, "uuid": "b9618109-a29e-45bf-a223-3915cd76539e", "value": 1870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323873, "uuid": "8d0358a7-cb3e-4daa-8cee-9cacc8680053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323873, "uuid": "07b0aaa2-a8fc-4d9b-ad79-d078bd30de14", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec2866a-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307301, "uuid": "49faf3d2-0b21-46bc-a773-5e1952be1ba1", "comment": "Malware payload", "value": "7eb332a281969c76952619d2a35790de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307301, "uuid": "e8b9ff6e-312b-477c-8534-7671cf66ac96", "comment": "Malware payload", "value": "135e978d6a6b1d079f669ac7514b85232ad2b3a9eae7dd5571453f3ea1b266e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307301, "uuid": "8ea9faa4-a62f-4452-949e-f6c28c58dbc1", "comment": "Malware payload", "value": "bfce75c36617d169bc49fb84eb99e6e214180c7b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307301, "uuid": "ffa34f52-a28c-497e-bc0c-e578e4679909", "comment": "Malware payload", "value": "28cfe2ee7c4be2ee6768fd13db7ad374dd6c0201f9d34ffabdfa1af49a942ce8e10115d490b6d0bfa66b233620ddc44f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307301, "uuid": "b4a84c3c-6ebc-4f20-aa9e-ef8a6d45aa9a", "value": "T1FE52D1D7E2951737D611E051C00A484B1FBD848F98F22723B3EA4CEF996505E3D18EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307301, "uuid": "7f7efd85-7095-418d-82e9-025efad9109b", "value": "384:iiHJp4xf6z1BpebLUXRwNPto8gyesW2xllHuEO8ugySHcdko9U:iiHJ2+TiLcRIPto8pesncETHcA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307301, "uuid": "67e0e17c-84b4-4a93-92fb-ddb8f2195e32", "value": 14337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307301, "uuid": "c9bd03e4-6822-47ce-9405-24e25b16f5aa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307301, "uuid": "bb677050-0f87-4461-aae1-0c3a78e14765", "value": "images_20260729_030742.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccb4a4a-8b93-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785360045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360045, "uuid": "27b103a0-1610-4e03-8868-4175acbd22a9", "comment": "Malware payload", "value": "f94f81384c09055ad220442654bd9119", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360045, "uuid": "c71af5fe-197c-4878-b465-8b1c3e73de97", "comment": "Malware payload", "value": "13bd0b75039576c6b5f249e507cb5de04300c83b2971edd94686659848c504c7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360045, "uuid": "b764524d-7ae9-4ca3-ba29-fe216ba0176c", "comment": "Malware payload", "value": "4a58bf3046d040dd03440280776b8c2d4f221637", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360045, "uuid": "be1c242d-3412-4c4d-9c94-274b19547a26", "comment": "Malware payload", "value": "91f1fc1f76cb5f2293a2df800ebaeefd2a411e567ba22e6db5f24c0f4dd39bce8493e2f42667c7e1d5773ad4092e03a4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360045, "uuid": "3573324c-dd25-4f4a-858c-ad7e3340bd2d", "value": "T168C63302E71DB453C9F3A23A7F71472664275CA64712E2831A71F23C9DF7BC0EA59A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360045, "uuid": "e10566a1-876b-4111-99f6-b67f9afe5a69", "value": "196608:rkV2mexLLi9wmRlVns6WXdFN5oYhfolHSedBy3BACbXApVn8kQwuNQ:dXFijnsPNFF2xdAxACbXQVn897NQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785360045, "uuid": "dd670cba-c41f-4122-b007-330cd933ab12", "value": 11994589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785360045, "uuid": "585b7412-dd18-4ea8-a237-020a97f8af9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360045, "uuid": "2ac42c80-59dc-4f33-b127-0d197630da99", "value": "iMobile Lite.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f48c0-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323886, "uuid": "58a03e88-7c00-4a65-b170-3328fbd8d336", "comment": "Malware payload (Mirai)", "value": "903885fd4832da3f7852ff0e9593c04d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323886, "uuid": "8b936ffe-bf82-4d73-ae59-fc39dff88e4f", "comment": "Malware payload (Mirai)", "value": "142b78add17ae70fd5e5d3d5d3d66bec9fd2ac2ea1b4a11ef2e95538de829446", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323886, "uuid": "e80d352c-2bb4-4e01-a8d2-cd51bcc25ea3", "comment": "Malware payload (Mirai)", "value": "2ca48296758cebd8d36c25a0d0a6ff39e0bcd3f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323886, "uuid": "02480def-0a67-4ad0-9017-a01f14231e12", "comment": "Malware payload (Mirai)", "value": "de31ddbfe3b388712fb2cb586cd172809914fb1e25e11c49084c661c4528daedc34f32f2666dd67f7e402ab8548027bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323886, "uuid": "62fad306-af8d-4681-a166-09b9d3ed7be9", "value": "T182832A02B9C085ECC089E138077F763AC425F1BD627AB2D73BD5BF1A2C19E501B1EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323886, "uuid": "751c0744-8328-45a6-9c1c-36191a4fc26b", "value": "1536:ATNuOfMLWePYeNnVTbBub63gbyLa47Yj0ZOYhMsQvRDiqYRKROEbMgU:cHBePDNnlNub63gbyL/Y2hMs+RDiqdR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323886, "uuid": "245765ef-8cc2-4d0e-8060-f1b51fbb905b", "value": 85248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323886, "uuid": "1b18dc4b-41a2-4f5c-8622-092f1c7d2e88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323886, "uuid": "74b68709-ec38-4cd3-89a7-11ff8cc6c057", "value": "MMaaRRiiOisecTanee.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8352b7f0-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333052, "uuid": "2385f666-5d10-496a-98d6-4d5d6070a714", "comment": "Malware payload (Mirai)", "value": "031a4ee858d60fd7b423bc9b3c4d30a9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333052, "uuid": "d3220a9e-70d7-4f12-9590-2f6bd0d4e46b", "comment": "Malware payload (Mirai)", "value": "155f0ec763ff3db0f48796e55d1401620dd739d66ab88a8dd78d8fae18cfc79f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333052, "uuid": "79bfe4e4-b3eb-4c54-b706-cde3a360951f", "comment": "Malware payload (Mirai)", "value": "2365cd877d570e375a634fad0207c43b77a36bd8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333052, "uuid": "fd34a4a4-6c7b-4ceb-bef5-4550c7df4980", "comment": "Malware payload (Mirai)", "value": "55fb32b7ac0f5e4a614adfc44164e43d46a4bb06ef01b1c71264a9d6daaf34475e8b1b46d3af2590d252332fc70ea235", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333052, "uuid": "3e1b5a54-9f5f-47cc-89ad-20b55d1bbadc", "value": "T15BD09EC830D07793CA8A8F10F16104C5E2CF59895FEF8794D0D958A5A59FD8078776A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333052, "uuid": "4acfb180-8e92-4f6c-b6c8-d3375b3b2e91", "value": "6:hoKVUp/u6uEUp/u6yZJNHu25jVUp/uRtCEUp/uRhpKzEn:lUp/LhUp/LyZC25RUp/aCEUp/6w4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333052, "uuid": "606f5d69-ab8d-4add-9962-a7350435810e", "value": 235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333052, "uuid": "8351c1fc-680a-4159-b332-a6a11d17f7e1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333052, "uuid": "1ce01c2e-5ad8-4c57-968c-77fa9c8cc70a", "value": "p2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5d4622-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload (ReverseSSH)", "timestamp": 1785333362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333362, "uuid": "522d8b61-00cc-4d1b-8495-c5d9402353f0", "comment": "Malware payload (ReverseSSH)", "value": "427258462c745481c1ae47327182acd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333362, "uuid": "1af79fd4-8e3f-4c50-9795-6ce7452a1156", "comment": "Malware payload (ReverseSSH)", "value": "161fd76c83e557269bee39a57baa2ccbbac679f59d9adff1e1b73b0f4bb277a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333362, "uuid": "79552cb5-e5a9-47ec-8579-da9d8d808301", "comment": "Malware payload (ReverseSSH)", "value": "ef8036eb4097789577eff62f6c9580fa130e7d56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333362, "uuid": "7c7c2c37-14ef-4367-a785-0c2979333c0f", "comment": "Malware payload (ReverseSSH)", "value": "fba2ddf71c8e8c6b8b686801f4890309d6ace353b04f4de53f886ec601edee1732236dfb20164efee7fd8d27d6f1f37e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333362, "uuid": "820e53af-8b47-4132-ba0d-c42c3c510d00", "value": "T174064C03F89150E9C1AED535CE699263BB717899073027C72B50EAB92F77BE45E7A300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333362, "uuid": "88042838-987b-46ab-a701-d536a57a42bc", "value": "49152:e0a9cuyWrb/T4vO90dL3BmAFd4A64nsfJyBnmWiXpFUUXGo0331m98Hds71gnoa4:e0Lda/Uvd3qG6bpsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333362, "uuid": "17eda683-af4d-47b2-8746-9a32dfddac15", "value": 3690496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333362, "uuid": "3b35289e-ad8d-46d8-b7c2-5a2097540645", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333362, "uuid": "5f35b25b-92e2-4f90-b20a-07266a845ba2", "value": "upx_reverse-sshx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f4ad6f-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785334076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334076, "uuid": "823f9b69-6a58-48da-90f5-c1c6148a71c2", "comment": "Malware payload (ConnectWise)", "value": "682a8c5dc87cb706bb33221e61975d09", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334076, "uuid": "2f819438-1434-45a0-ace4-c2245ba69d46", "comment": "Malware payload (ConnectWise)", "value": "1650509e245d62930fcd56d8f8aafe5e8ed9a57c746f027d7565fc732b77d7dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334076, "uuid": "cc860158-6798-4c10-83de-9b4898d5a87b", "comment": "Malware payload (ConnectWise)", "value": "86447ec71d44aa50477c04dc0f3bbdcd9ec8a2ff", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334076, "uuid": "d4c0458a-2a55-4ee3-982a-a0829be45963", "comment": "Malware payload (ConnectWise)", "value": "e8e6c08d608bf2874805fae0e0a89739da970d72bdf80bb2f59ae23f214624e926a6abd3dea42c48465516d3094315bc", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334076, "uuid": "d17515ea-40de-4e7f-862f-4a87730a3794", "value": "T1D4646D11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334076, "uuid": "f1b21d5b-9787-4254-8508-ab4fd4ab13a2", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334076, "uuid": "1f521bd1-1ca8-40a8-a7f7-9abfdc31aa22", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:51iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785334076, "uuid": "d89bc0f1-8ebb-4ea6-89d7-639078c24ef9", "value": 312552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785334076, "uuid": "55b3d6bc-91f5-438e-ab63-b1fa62417101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334076, "uuid": "8b75f9d4-e709-4521-b732-cc63a160aa3d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715df539-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320996, "uuid": "b21c6afc-33ed-41cc-a7a3-f410d9394d74", "comment": "Malware payload (Stealc)", "value": "52f00e919a910e2445bcd4d35e896693", "object_relation": "md5", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320996, "uuid": "6e9fe168-0f9b-4ad0-bed1-81e6b52ef4ec", "comment": "Malware payload (Stealc)", "value": "16efe20ecbe454a3390e05e1641c91bbbf436a2ab1c830b76dc6c8a8b4843f14", "object_relation": "sha256", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320996, "uuid": "5af85391-c29b-45d2-ab13-d2e9d2aa18dd", "comment": "Malware payload (Stealc)", "value": "2517ee6b0331e10067fc6f4e79b0e237a9db3504", "object_relation": "sha1", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320996, "uuid": "c8134669-2387-45df-bd37-ecdb18c13263", "comment": "Malware payload (Stealc)", "value": "789ec0a917792ec7e3d9a1c6fd32d502f43ebff0a3dc0a931a64c3c9e2f79af0ec6a9049843aa72ed3e61f4f105511e2", "object_relation": "sha3-384", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320996, "uuid": "a0b24056-1001-4f14-8723-0d26b579f0fa", "value": "T117F48D1AA7A502E8E07BC175CA43C943EB7278565330979F03D54AB63F336A45B3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320996, "uuid": "79dd8576-f508-4c9e-8222-c2e21aba3ae8", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320996, "uuid": "fcc1326b-0e28-4536-8fec-f7148202ea4f", "value": "12288:p6HSXamiqz8TbhvbTOMfJr6EmV8Mw0FVeyxBlDetAqxSv6c:JakzIbhvbCCJ+pVw0FVeyby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320996, "uuid": "c4efa071-144c-4ec2-a96d-e5c179ea796d", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320996, "uuid": "24c8aa22-b4d1-4408-9d37-c8c57332aef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320996, "uuid": "fd455ab9-67e6-4e20-9d04-0d1d3c94de7d", "value": "16efe20ecbe454a3390e05e1641c91bbbf436a2ab1c830b76dc6c8a8b4843f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbd3450-8b16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785306226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306226, "uuid": "c69373a4-1e7a-4b4a-99a6-42e76d21c05e", "comment": "Malware payload", "value": "9d78ece09457907b730d139e4e0c64dd", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306226, "uuid": "f1562711-309b-4dee-aa0c-084faeed97da", "comment": "Malware payload", "value": "188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306226, "uuid": "6c3064b9-39b3-4c3e-935e-b7b48f28566f", "comment": "Malware payload", "value": "8473f85bda00dfa3ecd2385dd38f69600d1d64a6", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306226, "uuid": "5fa2ddb9-89e2-4f79-b743-fdd14ceeecf7", "comment": "Malware payload", "value": "40a0f970a77875fbee883352ab7dff8f32eed4fdb6a819dfa9165e5922c89e17a740dd1ba8dd50b09f0df16cc3d43c95", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306226, "uuid": "c100edaa-4b15-4088-ae6a-7f3fdc8b13a7", "value": "T106076C66FD1D3872C6DD75706F5653983239AC049B82C3261624BB29EEF27D88F23271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306226, "uuid": "8c121cb9-b75e-4776-95fe-b9d1faf74228", "value": "98304:SXEiSx3jh8gijYBXV3EP2937BAspGhZRL2aU7ucEtUvvSuXAEqq1vI3eoq:SXixzh8yBl3Es37iZ/RL2aWvSuX5Bf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306226, "uuid": "da19bdff-40dd-4584-b7d5-92ac96bb4744", "value": 17560930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306226, "uuid": "5177cd63-1705-4683-8af8-87fb646a9457", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306226, "uuid": "7adc5773-cff8-45af-aa5f-c11460eb29dd", "value": "188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6e4591-8b7a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785349227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349227, "uuid": "b5c8b33b-0e61-4e62-ae59-e72503c67f88", "comment": "Malware payload", "value": "4201f4bee6795308915fc526773e1201", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349227, "uuid": "100425bb-604d-4199-9a09-b11baa1efa44", "comment": "Malware payload", "value": "1916cfab459307852b4d845e05b4961ffddf742988d22d63531beffc7ec30e7c", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349227, "uuid": "c41ce083-d9fa-4404-aa01-7d54b52bdfe8", "comment": "Malware payload", "value": "79d18e501ece7dfdd617805a2ae88a41ff298f14", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349227, "uuid": "65991a3d-3ff4-4486-977a-59d3222fb04d", "comment": "Malware payload", "value": "8aacf16fd52e19c2760d8b5f6f6c7625eb4ba1ba22695745600abb68216c3e08cad6c18e1db39bc35ac4824ffbe130b1", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349227, "uuid": "1937679f-0ac9-462b-8c9a-f929afa8e0ba", "value": "T17BB63305279B40BDE2DB753C84328019DF2B391D1CE270B5AFF8E65E0534A589A7EB72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349227, "uuid": "04ef0670-838d-4174-b2a2-8be7d18e842e", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349227, "uuid": "f3684bb3-9d54-4b8f-b87c-7856ac5702d8", "value": "196608:d7q9w+Knw6b34+mXTnmte18xiyPHgjzgmcK7gkmP2sZ9ZObwWa6zXUuqLxj:89whnwo34bTnCeoHEzA6g52sgblzXUu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349227, "uuid": "560eac0c-70a1-46ac-bc3f-20a36cd8e889", "value": 11352255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349227, "uuid": "e718be0f-ef64-494d-9b9d-e7a2310d3342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349227, "uuid": "9c1d474c-2958-403c-8622-ce46da13eca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ea43ca-8b1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785308890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308890, "uuid": "4886dd3d-502f-40db-a5f8-b3de5d8ce9c9", "comment": "Malware payload (Phorpiex)", "value": "730fd4dedd5f0fed6b40f6f95a3a7eec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308890, "uuid": "fd154ab5-5533-4793-9a0e-8f504ec33af9", "comment": "Malware payload (Phorpiex)", "value": "1945428f1a5bcac0595556d7acba0802c96ef9d9552a91c77d71f7bfd89c22f4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308890, "uuid": "600a6397-1661-432a-9ef8-4d145f526153", "comment": "Malware payload (Phorpiex)", "value": "e8a8e462c5a5252c2e065fc11c7b59012a2d8605", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308890, "uuid": "81ac6a8b-f888-4dbe-b3ce-cbf6e6637dba", "comment": "Malware payload (Phorpiex)", "value": "f13bff91b78849f72fcfc56a2a05742d6ce9107750ad859ad3218b1438074d130e7d8ca2a824f38e18764317de1f41c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308890, "uuid": "1d49ada8-0ac4-42a3-8a4b-bb6c4ae0c02c", "value": "T115822A0FB8424216E1D110B4957696BBD9B99C7633C418DBFBD44AEE0A686C5FC3250F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308890, "uuid": "eca6992e-6e49-4553-8dc8-bb9f4e504e53", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308890, "uuid": "d5059caa-1b83-4bc4-a187-ec4f66616ee1", "value": "192:AWx6SkQzngjoWLsmBDTlIUqRQsPcleSMv9fKUSiu9zwfge+VOgbOOqmEd6FQv9PV:A+ZbmsmBTsU0Vu94gXTPuav8U9c+t4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308890, "uuid": "43a4388a-7d70-4321-adde-6d2adf5e83ef", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308890, "uuid": "05e9c164-ddf9-40bc-be48-41a5c363af66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308890, "uuid": "b9ab6db8-cd86-4e6d-b2ec-b709e1e47df8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ee1d86-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323879, "uuid": "96ee7e2c-e150-46b8-9d69-1b5de2d02c01", "comment": "Malware payload (Mirai)", "value": "0d2ce77a8e4713ed1a3ef03672379eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323879, "uuid": "3b6e971a-c467-4ff4-8370-c23b1213bc0c", "comment": "Malware payload (Mirai)", "value": "197c435bd667bc44ae26a92898c34c36f8a093228409fdf5340fcae9ccabd642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323879, "uuid": "a8b0a929-d10a-4aee-ad66-8d68991f6703", "comment": "Malware payload (Mirai)", "value": "cdaaa04cdf00d9561e01de092dff8d31f26e6ff0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323879, "uuid": "3229ec7c-1151-4c18-9367-89e89b77f76b", "comment": "Malware payload (Mirai)", "value": "3a9ffcb9bec52b7cbddd49c2b42e7ac493b6ded39b56a1cc9398dc54e319d598e2f068173acfde82ae9370167168dba4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323879, "uuid": "c6c2c977-ed09-4691-8d97-05fa24c2c2b1", "value": "T197B3910A7F600EF7EC9BDC374AAA1B4924DD641A21A87B75BD30D818F24B25F15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323879, "uuid": "9237a2a2-85a7-4a27-95c4-5f84719e9705", "value": "1536:VTUAnPWQ+tbHc2cAd88LZAJb7zEUX1p7VwZ8aD2A2j6Z3ktkprw6:1UAnPWQ+tbHc2FhNw1pJlj6jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323879, "uuid": "e5fd846c-04a3-4157-8396-21edb82c6613", "value": 116916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323879, "uuid": "6ca05824-e3bd-4688-a226-d31a2e4c13a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323879, "uuid": "f1bdbe70-87ae-4330-8e18-d3111c320cf2", "value": "MMaaRRiiOisecTanee.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902f122c-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305156, "uuid": "41ce0487-28b9-4e4f-bdc6-b802dfb97788", "comment": "Malware payload", "value": "385d1ab7c1f1d01e8c401634b3551eca", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305156, "uuid": "582b6bd4-309b-440a-b954-1024af772afa", "comment": "Malware payload", "value": "19c0c5a7358609e8fa7274147b7637b038a5510846eb5eae2b2e64cfbdf078c9", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305156, "uuid": "97dfe423-2da9-4c38-bcaa-d31a396d1a3e", "comment": "Malware payload", "value": "eb65e9868e745a8d95af7db74be002e466df04c2", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305156, "uuid": "36cb1e1e-f21a-4dd9-b41e-140ca033d31f", "comment": "Malware payload", "value": "1d440b45d754cdf38addbbd055e563eaeb92285eff499f9c3007184c864d88aa57b75261df40b24c4b0a5079dfaae22b", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305156, "uuid": "2208c3ba-114f-4939-8fe8-731cddfc51c1", "value": "T194C59D03F6155D32CACE4575D8FA17587730739AAE8347562A28D8ADFCD33C782E8289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305156, "uuid": "58331cdd-bca0-4ea7-917c-ae1059600c66", "value": "24576:434l/D9KzPaVsxKQjUfofmfsftm/ix390k3R8BMPvK8FuIORFaYuRuJwivtLHw3e:42bVIJjSmMqgix390kxzDOavRuJwiqxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305156, "uuid": "f6a785e3-194a-4b45-b62b-1ce188ea8c78", "value": 2717620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305156, "uuid": "12da0b4a-27be-4e4e-a9b1-98a17199de7b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305156, "uuid": "e895957f-8c00-4feb-b8dc-f1fbfaed5cda", "value": "classes (3).dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9976a0b7-8b3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Worm.Ramnit)", "timestamp": 1785321922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321922, "uuid": "0384dad2-7044-485b-ad0d-046874b9747b", "comment": "Malware payload (Worm.Ramnit)", "value": "aaccc00c1a56e171d41aaca42d78b989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321922, "uuid": "a4edec74-c18b-4b9d-a008-2ee8f606c888", "comment": "Malware payload (Worm.Ramnit)", "value": "1a020229e3b01d58230ab2512fdb373b22d91676b441a792240a01f72b27affb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321922, "uuid": "053bd9b4-4d84-4ae1-b7c5-b7d0a29cee35", "comment": "Malware payload (Worm.Ramnit)", "value": "073bc2cf28961b31d1d8d8906e7256eef4444766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321922, "uuid": "2e5195de-d89d-401a-85e2-9c387b593c79", "comment": "Malware payload (Worm.Ramnit)", "value": "0b4feeadb83801c859de5f34be7fc74c2bca2b5ce1dba53ea75b03f8310fdae80f78806093fb17f0be25a2591535ca84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Worm.Ramnit", "colour": "#8B8B76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321922, "uuid": "085d3d6a-fac2-4aaa-bc81-eeda2758f19d", "value": "T1F744D08E2307C8E1C654463451CBCF89AFA2AF305C57A6D81B447B6FDD775C2982E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321922, "uuid": "50f67e63-ad1f-441f-9764-583c483d4451", "value": "d00eba105c91071d7abbd2ebc2d1eceb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321922, "uuid": "0c97352c-08d0-4dad-aa50-350cc935899f", "value": "6144:LdpNiLCdAatGPpsdpNiLCdAatGPpsdpNiLCdAatGPpU:jNiLC6sGR6NiLC6sGR6NiLC6sGRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321922, "uuid": "0cf88852-495e-410e-9ccc-da0939c7509a", "value": 260967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321922, "uuid": "82884e5a-745e-4d4f-92df-2fc43860b250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321922, "uuid": "b853c399-ec67-465d-9963-d11d015406a8", "value": "1a020229e3b01d58230ab2512fdb373b22d91676b441a792240a01f72b27affb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92751806-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350686, "uuid": "895f6c0e-ea0b-4508-8f18-390165910c8c", "comment": "Malware payload (Mirai)", "value": "ad7e6fc05ebccab468801cee6d25b787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350686, "uuid": "5dfc3adf-230a-4b40-b506-6a39f215f6b7", "comment": "Malware payload (Mirai)", "value": "1a62ab32f8f5e760e6b4c1cca8a8001ba031e6a00a6440de4cf6e2d37eae7283", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350686, "uuid": "44d7faca-02e1-4cb3-9c83-a30d57348256", "comment": "Malware payload (Mirai)", "value": "87fa6a00910b49262fda9d951ddcd7a072675727", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350686, "uuid": "54e1ddd9-2e74-4dfd-841e-5b97391b00df", "comment": "Malware payload (Mirai)", "value": "901a5adc76f8a2ddaeb066762eb3b88203324d68d8729274808b15d512ece1f12cf3e5a49169399b669129e8258529fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350686, "uuid": "7583b50a-b789-4b18-9c5a-347975c31fe6", "value": "T1A183090DE793F9F0C99206F4101FFB3BD872C8A132609CE7D7E47BE696625819442E59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350686, "uuid": "f9fdfddd-f971-4d5d-a8c9-c0f6a82fe5a3", "value": "1536:38g5WHY1rnWr3YVo5CYVPlnMvUCj5S8qBifVZ:H5WHY1rnWr3YVo5CYVdAwXiNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350686, "uuid": "83d7d9cb-43a2-4507-99d7-981e82a1861b", "value": 82524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350686, "uuid": "55f7bc6a-0686-40cc-b75a-3150f75941a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350686, "uuid": "7a5d17e2-a1d5-4265-8126-6751b5027d88", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d6b433-8b52-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785332303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332303, "uuid": "2b1f76e5-9957-4019-8c99-3021f59c664e", "comment": "Malware payload", "value": "4d46f92ff02b56bfaa593a51fb3f7687", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332303, "uuid": "d4fd9693-c178-4198-8d4e-f1564ff746f8", "comment": "Malware payload", "value": "1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332303, "uuid": "8ab6152d-bda3-40b1-becb-7e33f28cc815", "comment": "Malware payload", "value": "1f97896bbd339f33fb47cb407e56866241a79ec7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332303, "uuid": "ee35a1c9-10d9-4f8c-a895-1ae163c6e2aa", "comment": "Malware payload", "value": "8f829f66db4ec5c423d27a5344730905ced6b84a49685f613dc36e0d65e4db8c6866dbece8b20e9f5103b7b3007d5844", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332303, "uuid": "f524d015-8ba7-4541-93d1-7fd7ecc3d52d", "value": "T13001AFD9E1609D00109D946C239F9094F431C3CB158B8F74BFACA47DAB98E14B02EF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332303, "uuid": "a9be926c-b06a-4949-b668-2647f2786276", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaQCw03HOCNFxCk5F8C7kzuU88CjAX:kXCKysE2hi0ziQvZohaQEusbv5+g8GAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785332303, "uuid": "47e058c0-7d52-431b-bec9-8c6e8c11ba5e", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785332303, "uuid": "98a42853-489b-4d87-bcb1-62c8a7f8b745", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332303, "uuid": "3b34c065-fb23-4eb5-9e3b-578f241356d4", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84b6ad8-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313840, "uuid": "95adec02-5e6a-45f1-a7f8-54d0b346b0b7", "comment": "Malware payload (Mirai)", "value": "70d1f1a305c71985da0b939b7d94967c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313840, "uuid": "fa2968ca-d065-47a9-ae44-96baeb927a97", "comment": "Malware payload (Mirai)", "value": "1bf1340c4954246861b4901b6a06e1aaa79ef186d1950dbc7f1c22a023f3f406", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313840, "uuid": "f0ca0488-a3de-4613-944d-08299c844cdc", "comment": "Malware payload (Mirai)", "value": "5a495e2eee270a7e749f234e7a246c00782d0903", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313840, "uuid": "85710ccd-2724-4ac7-9546-5d1a9207e5b5", "comment": "Malware payload (Mirai)", "value": "0af1c71b70ba4142d65c919395ee3d369582ff7b4f1a0df31192246be1d3b56c2b9c8a9dc98ecadb49076e35bd15986e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313840, "uuid": "0b745643-261b-46af-a132-5ceb82ea6266", "value": "T1F4F48D1BB2B2B1BCD11BC03047DBCAB24532F47526312D7B26C4DA353EA6DA1176DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313840, "uuid": "8e7047a9-677e-4312-ab1b-34b7a7eebb29", "value": "12288:lNq2SBM0IyRkoNgfw2BUedwH/IKn/WgDljTayUfy+HX:lNq2Ksy2oNg4SS/WSl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313840, "uuid": "a30e27f6-66c8-4063-b5b2-bd3323053ca5", "value": 751728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313840, "uuid": "4ba5c07d-84d6-4075-a582-22a3e352c031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313840, "uuid": "ace65261-2ab2-44b3-9f04-16f158e51c34", "value": "real_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f35898ce-8b34-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785319496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319496, "uuid": "37962043-1ef7-4055-96e2-475da0799625", "comment": "Malware payload (ConnectWise)", "value": "e76d61ff0b8f528fa958b514f9a521dc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319496, "uuid": "1ce5eff8-e79a-4f9f-baf9-c1d6e4229830", "comment": "Malware payload (ConnectWise)", "value": "1bfb41a19de49c9c0dc63f434ff46f51ccba78e25629031bfda16e56b0f09df9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319496, "uuid": "9c4635fe-1a6f-4a3e-9755-c077bd2e5275", "comment": "Malware payload (ConnectWise)", "value": "6b610c48d11f8876b97c8bbdb6e9bf112ce63362", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319496, "uuid": "08ce09da-82b9-4e71-b0f5-b7aa22331f7b", "comment": "Malware payload (ConnectWise)", "value": "9dcfd2327427d2db492ac1870ab399c2c6b90b621ab76546514e335ee2ebab882eb6506d81b46729f8b524b9e3847845", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319496, "uuid": "5a2232e5-7294-47a3-9018-0a69a0edab5b", "value": "T137D61211B3D6A5B6D0BF0639D87982A55675BC058B62C6EF53D4B92C2D32BC08E32373", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319496, "uuid": "f684f69e-5f47-4722-affd-1db6521f37db", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319496, "uuid": "44b6d675-3fd1-499f-8990-61590e18f273", "value": "393216:V2xiFxbwpaNCl2xiFxbwpaD2xiFxbwpag2xiFxbwpaX:cUFxMpQCMUFxMpxUFxMpmUFxMpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785319496, "uuid": "a9e3f91a-0f50-4bbf-9272-7bfa6dde94e9", "value": 12809272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785319496, "uuid": "9aa87ff0-f784-4853-bab5-35b5d621b041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319496, "uuid": "e797d19b-4c86-4ece-af45-3a941789365c", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a708df28-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324522, "uuid": "980ff654-f070-4e99-b5c0-53656a5493f1", "comment": "Malware payload", "value": "c7803aef10683578ccf96af61eed1db0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324522, "uuid": "32deabb3-e99d-4f2d-a643-0f2849ea8373", "comment": "Malware payload", "value": "1c27866a299479060701f024dc15f17701616f786a06baa3c81a032932653eaa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324522, "uuid": "8ac6baff-fa96-407b-a52b-8f30e7ff1d40", "comment": "Malware payload", "value": "b563cefc32e051c5c09bae6c962b3912292162e4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324522, "uuid": "55c944ca-6828-4013-a9a2-c6cbe53d16ca", "comment": "Malware payload", "value": "46ddf6dea3f8e683a35bd830882bba70acbec72db20aabd9f36b6e84c44e2d1088ae092edef8f2c79d7fed293c5b30a9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324522, "uuid": "1b8bb7ca-d53c-4c93-9054-1f56f007b90f", "value": "T14D218911C33389A5C46BA130BAF6F3E5616510192D38FB5AC711D1C52D2A58857E5075", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324522, "uuid": "800f08ec-2ada-4f7c-be11-1dfed49f7b22", "value": "24:9yPx2b+6e9+weuKjPD7d6OiZZ35dqF8Q9e6WXb4R7mknsMhrwUENSV6MliGHRkB:9y5o+p4weuKjV0NC8EePEZTnFDUSVhi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324522, "uuid": "c9551270-5c9f-4224-a8d5-f70b82bdbe11", "value": 1407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324522, "uuid": "e5154a90-0265-4af9-9e22-129e23a74cbc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324522, "uuid": "1411b47b-db79-4104-afe4-ebf7123bd300", "value": "photov_593373192028.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a45a6b48-8b4e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785330530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330530, "uuid": "19b7daa1-3139-4d39-b4d6-f2f35ad4d438", "comment": "Malware payload", "value": "cfa54dbbc5c3b846f7059283b479f521", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330530, "uuid": "a01dfa91-8c3b-4129-b04e-8e68fa67c123", "comment": "Malware payload", "value": "1c7a1cba990b09786a6f27ca39ca8779ac0f4702ea62402b87aeb0bafc64680f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330530, "uuid": "7e4caefb-d449-4c28-ae5b-3b73e400d4ed", "comment": "Malware payload", "value": "416a4152610e616c219989e63f676e8b3f048b91", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330530, "uuid": "ab8d1e70-a20c-4861-9ad7-2c39d10f60af", "comment": "Malware payload", "value": "d00650fd1081f2bb5e57ace5d55cc8c86a872c43f91eaa5f136653642a09390a0d68b400128a88828946cbb2326c2cd9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330530, "uuid": "eaf7d8f3-b227-4b79-a8f6-90a848023729", "value": "T1C771755BC34EE465A3DE6C209AFF2C16A8FA56221B390A840E705C663CA06FD79414CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330530, "uuid": "6b7e92e2-9c05-4497-8c26-b8f00e9cd7aa", "value": "96:K9JrZyJca55ZOb8WrC6vULUhTnfJJlNhlbOM:K3xaBA8OC66UhTnfJJ7hld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785330530, "uuid": "1a575897-05f6-4922-bb1f-1d94bc41c53a", "value": 3539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785330530, "uuid": "d3a5a476-43b1-49cd-9ce2-478fb15a84c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330530, "uuid": "d624bfdd-2f96-489d-94a2-982f72b7530d", "value": "Richiesta di preventivo n. 8578\u00b7pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799f6638-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324445, "uuid": "e44082c9-da10-489e-870b-ac84e414b5a4", "comment": "Malware payload", "value": "1139d1a3a3946b335badf35436403d91", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324445, "uuid": "23be0132-90e1-469e-8b0d-5f83204f63b6", "comment": "Malware payload", "value": "1cc86e48d10d2f9a4d986ade1189cdaa773312db3be38f2031ad6404e843533b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324445, "uuid": "0baf7b90-ed86-4e47-a413-b6997e727081", "comment": "Malware payload", "value": "0bd8776766e15d7f803595d11783ee67b03860e0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324445, "uuid": "96c29131-5e35-4117-9c8d-65fba6d40679", "comment": "Malware payload", "value": "fd33744ba22a50412842cfcf5e745ba7fe5795a9a8d115ba0da4bcfa3e83a520e92478dc87788f219619dfac009ba4ab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324445, "uuid": "7c13b672-cf9f-489d-a683-ffe864ae1925", "value": "T17721D8024210E081C84EA3F87F329FC5B1571297114BC02F02AF2954FAECE44FFA1AB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324445, "uuid": "551a9397-8c53-4d8b-bd6a-f5befdf090ed", "value": "24:9tQvmOsgqNc23YZUZD9aTeSL3EGDsfcCWmkg/5cpeYSp08Oiyt6kBd:9c23YZErelDsfVWTYcpeYC08zyt6kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324445, "uuid": "0b963562-28db-464b-9303-5ecd85d48f79", "value": 1432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324445, "uuid": "ced2c92c-76b5-4b00-80f2-b048fa6eb667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324445, "uuid": "9353321e-ac90-48bf-8a95-7a8562a5da67", "value": "photov_445026867896.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d199c992-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350792, "uuid": "a31ce66b-c5ad-42e7-86ea-e78d4e9a1616", "comment": "Malware payload (Mirai)", "value": "303401ab9aa33f474ee5481db9a617dd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350792, "uuid": "ad1744bd-f62f-47e9-a47b-c3804231e837", "comment": "Malware payload (Mirai)", "value": "1cdd76bb77fbcd5061671c61c6176ddfa6ec10c0761f727cd73c60e6e93f9e1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350792, "uuid": "57aec520-e790-4895-b5d3-ef15f5820a40", "comment": "Malware payload (Mirai)", "value": "9d208ff30d7068cc456607edd97b5b4410db67bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350792, "uuid": "e0b62077-700f-42d7-b106-fed8c647a3f9", "comment": "Malware payload (Mirai)", "value": "04b461afcd95e2f9c41a3f09f50e8631c03b97b1c67eab926154a393a4c6625991c935b2ffc52e6c11052bcb30867228", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350792, "uuid": "7df252f9-2b61-49fa-8748-31425f768429", "value": "T1C1430245444C3F06D3F8247FB0AE818AB7314934E4278557AA14E615BFF16F9BAB0F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350792, "uuid": "4fa4f94a-8296-4032-a011-9f5f35208d49", "value": "1536:6tGLCgs3SBHOxpM7lUrumW3hqUsY79PyMifs:6tWCgs3ST+rumYhP79aE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350792, "uuid": "c6ce772e-1d17-4d97-bc5c-482cc159ca83", "value": 60256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350792, "uuid": "5dd4446f-a6bd-4712-a547-b769a74ecd12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350792, "uuid": "d52f4d69-2c31-44e0-a679-4c70eb56c1b8", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9cf919-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307274, "uuid": "0e545bc4-8b87-4fbf-a7ec-b10e2c05f73f", "comment": "Malware payload", "value": "36b582c564d1df00639a9286e5dcfc3f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307274, "uuid": "4fb1f870-d590-49e3-b527-a8cc4d56b625", "comment": "Malware payload", "value": "1d444ca2efa23b7cfa48d5c01b7ea660f1b524d27372be5288a1d5af647f7e73", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307274, "uuid": "06d77523-dbf9-4c53-8a5b-b5edf65a6b03", "comment": "Malware payload", "value": "1d65f7381f5e4f72542a3e1a076ee173fa9288d1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307274, "uuid": "b1989f9a-81b7-436c-9920-4078ff1d280d", "comment": "Malware payload", "value": "9a01fe6be400fc53148c6cddf1a54be21a8a4b25428ab3823ce8c401f2a461d03d259f90161ae9ce5b1fe6368d71b54a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307274, "uuid": "b3121ef7-49ed-4448-b7a9-79102c4bd4c6", "value": "T1FC62CF124E8F4DDED67AA2BB65CC444BE7174736C5AB2E34C03422DB18CB030D48E26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307274, "uuid": "540d5625-ae00-4b1c-b2cc-cc2b0756fbbb", "value": "384:ed6BspZ3LagYrMV0hgEx7fnV7omosgnaSqJx2BpOMZ:edIGlLagYrhx7fn5+sgnaaTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307274, "uuid": "987eb9f7-e7b3-4964-9c99-8c587ad894b5", "value": 15166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307274, "uuid": "1c1abcf9-9132-429f-a28d-b2f36c70367d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307274, "uuid": "ae942359-0c9d-472d-b74a-3a646b097686", "value": "images_20260728_200359.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033a9750-8b21-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785310932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310932, "uuid": "3133bd63-7daa-4f22-a4c3-9c90a0aeaa5a", "comment": "Malware payload", "value": "aedf19d13f2ccd0b8ad3c22fcb91c312", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310932, "uuid": "a548cae4-b1cf-4eba-8de0-9180ac0c158f", "comment": "Malware payload", "value": "1dbc8fcb10b9fc3b08e0fc7c537918cfe6ed72cc0825aa1ba36262a55e0efba5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310932, "uuid": "2cff9de9-fdad-4b44-aa22-5a674b9fc45e", "comment": "Malware payload", "value": "3f017ab01902b5ccca8f6620283ee13231e06b61", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310932, "uuid": "0fb3197c-8321-4257-be91-2dd797ddeab7", "comment": "Malware payload", "value": "69f1585314d760be4ca670546284fac5f0e178208fdf3b323c8e91bfc3a80fd02b938512d6ef3f20e31d77dab11f08b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310932, "uuid": "64cb7d94-d730-47ba-a91c-f68b3a294a74", "value": "T1C9D1C5572BF48622E6BF473963B243A21677FB858603CB5E0CC8917C18A16048EA5FF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310932, "uuid": "22b14f7a-cb26-41a6-b78c-df0afaab49ba", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310932, "uuid": "fac1ba90-cd33-485c-bcf0-dec8d940fe23", "value": "96:nBOZevgB6+2U1Gpan0oUQglgnStCSP+yr3UJXOR8XhERGEE:nMZhwGVDnStCSPJr3iXQ8xERe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310932, "uuid": "6a65cc7b-3b49-4ccd-be96-cbe9243e4285", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310932, "uuid": "ff5aab8b-544d-443b-889f-91b460dd4c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310932, "uuid": "93759ac6-dca5-42ab-a325-dbe592b04a70", "value": "1dbc8fcb10b9fc3b08e0fc7c537918cfe6ed72cc0825aa1ba36262a55e0efba5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d8d5732-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333042, "uuid": "c76ceeab-e2bc-4524-a19d-09974a34ca4a", "comment": "Malware payload (Mirai)", "value": "9fd414c8a268277b8e6f21baa0a6cc6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333042, "uuid": "bcfb7312-98a3-48f4-96b7-4afce1f185e9", "comment": "Malware payload (Mirai)", "value": "1f18ea1bfe695b966354c922138ab79b4347f50fb7f35461ca298d9c0aea1527", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333042, "uuid": "1ddb856a-026f-42ce-93dc-a3cd46327666", "comment": "Malware payload (Mirai)", "value": "69755bb2761d971459242e0f7eb378e0fdd64f18", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333042, "uuid": "1d35ca9b-e278-4c93-b6a0-68e1ad595a5c", "comment": "Malware payload (Mirai)", "value": "f91c623d411313f76cbca0646e05a10db7fe7272bb6db48ce18c7b5f85f66cfc9159a90dab6a85f5403c2497994e35cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333042, "uuid": "8467f84e-0c52-432b-a3a0-4a746b021246", "value": "T10A145BA8BA0F6C41F2C2D3F9DE9C87E13E1735E3C7768971791212ECDAA39D94990502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333042, "uuid": "14156351-e6a4-4958-99a7-053dc8094443", "value": "6144:r0PV53hwO/yOsm1KZkqVdL7qExJKRnoq:APVFsCK/ARno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333042, "uuid": "d625e52f-339d-4294-ad43-8c5fc938490d", "value": 198640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333042, "uuid": "d6b99b15-360a-4fb6-b575-586e27555131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333042, "uuid": "78f82a5b-1375-41b6-86ea-88644059319c", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0bed33-8b3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1785321765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321765, "uuid": "cc8ea467-ecdc-4a61-89fb-173841f55c26", "comment": "Malware payload (GCleaner)", "value": "ec6a85b5e33265ceedccbf7ae41894b9", "object_relation": "md5", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321765, "uuid": "aea22d96-c0a1-437d-8f2b-2e8b52cff709", "comment": "Malware payload (GCleaner)", "value": "1f49316f60cee5fd365ecda4b1c43fcfe10ec5a52fd0721b4eeb811afeab77ba", "object_relation": "sha256", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321765, "uuid": "3bf9640f-7721-4998-b641-384bbd30dcdf", "comment": "Malware payload (GCleaner)", "value": "967f259e3d1df3af9cc90a645da8fec177eb0196", "object_relation": "sha1", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321765, "uuid": "13716384-a058-40c5-8ac5-1d741aeee846", "comment": "Malware payload (GCleaner)", "value": "58c12519eecc2a568e80306688854d144acd95ca3515896ad98588fb2128e97c2a8fc1c530c8d90b7053412bf0d6a0a7", "object_relation": "sha3-384", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321765, "uuid": "a0ef7978-f054-431f-855f-7eee0d01b4e9", "value": "T14636F13AE6C6CCBAC2665E7057AB17E5D11076872F68584B3CDA1808BB3C58F315D28F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321765, "uuid": "ace404ef-dd1d-482b-b41c-55f5ca0115e7", "value": "c85df4bfb526d5f0aabf5fbd3dd22def", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321765, "uuid": "0650374c-4a3e-4377-b92a-1b755183684c", "value": "49152:CXQvYR6S5hc3E3wyE0QiHOKyTrdhLb42aooDJdMZTaETvJRCB0iLaL:CggYU3wL0cTrd1aoX5RzCB0iLaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321765, "uuid": "cbfb36de-c6da-4bcd-83e7-b1a6c3b5c934", "value": 5022496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321765, "uuid": "ffe59984-58b0-422b-b216-36c2fe7456b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321765, "uuid": "d7110fec-f7ad-4675-a5d5-153a3a04e709", "value": "1f49316f60cee5fd365ecda4b1c43fcfe10ec5a52fd0721b4eeb811afeab77ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41b9267-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324517, "uuid": "ab0c7012-de80-4563-a5a7-cae0ac40f4f8", "comment": "Malware payload", "value": "cba7c6f605d98a2b765d0a8027afb415", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324517, "uuid": "d6f0fe36-ecee-48e7-8a3d-2e5816c24a1c", "comment": "Malware payload", "value": "20095f8b7368bb158850894fe6af6af04cb725ffe3a233a5ffba3c6c34732737", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324517, "uuid": "8f3b2a89-d216-49da-888f-15a2f8e2ee3f", "comment": "Malware payload", "value": "4aeac52a10c6e9cb083c623e750a630d5b81cfa7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324517, "uuid": "6f1ebe60-432f-437a-8d6e-6a9a8aab91fb", "comment": "Malware payload", "value": "c9b09d864b8a08590e01c8b23873bd69f7ca50ed4cbf27488d99e71d59e9601bd8e86bab2ef3eb81cb2a29260e807214", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324517, "uuid": "caa09797-cde3-4f91-bd0d-18360d8b0474", "value": "T13121C87D63D181C8CA44763BBCBDAE40314E9160AE81A5833C1B6A873BDA56A4F10A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324517, "uuid": "1a5a3ae2-806a-4a9e-b679-164a803f8f4f", "value": "24:9RpEUSUp3swf3Zg7cWJM/kbho0+bv+WieY2kmkXe+UaNuUam3HQ3tCx33i:9RpEUSU9sUZgaw+bEebkTXe+UkOMHUCg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324517, "uuid": "9f5c46af-4d10-4b67-9c01-b5b01c44ee2f", "value": 1354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324517, "uuid": "0e6d6d3b-8d76-4cd9-a472-ad4e9c0b36cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324517, "uuid": "334c4807-9093-4c8a-80c8-4aea98446df2", "value": "photov_336948176123.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8402d981-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307283, "uuid": "8573a00b-c277-4ef9-9e47-da02b800dfbb", "comment": "Malware payload", "value": "38856c7f778ae98a017c13de62bb57a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307283, "uuid": "682c6f52-eea4-47a8-b8d8-303fa7d08705", "comment": "Malware payload", "value": "20284424d188d855b0d544a01d48b7c2e56063b03d3a3f54cef382169480174a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307283, "uuid": "477e09ec-607b-48be-b852-745a612eb705", "comment": "Malware payload", "value": "1236324d54470ac38539c0eb2fa5801e064c09fa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307283, "uuid": "254d0550-6ac3-4afa-b5c6-d5cc4676febd", "comment": "Malware payload", "value": "e44f304e5248a90d1b3fa2031edf104006a589eb884b41703d19766bf35105bfcbbd4b1d9a5d54fc779d37c2acf4e7de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307283, "uuid": "5ab1964b-92f6-4e93-94a2-37cf2999accb", "value": "T10A62BF8AC300170A88DFB1BDB545F54A0A4F488EA59C6BF472A2B41C4D17AC36D99EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307283, "uuid": "8bda88fe-3b10-4abf-b464-e081a424b49c", "value": "384:TRfnPbymBiEdV2kfQhR5w4ukzTtxE8CZ15qIZCS:tTy8iEdpfQh3ZTt68uoIZCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307283, "uuid": "a514d81c-cfe2-45e2-be80-5bac17836849", "value": 14892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307283, "uuid": "fc4a0543-5a87-4fb8-805e-2fbe86585eb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307283, "uuid": "f72ccc18-5c94-42c1-9227-075b02047d88", "value": "images_20260728_075437.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b01f48-8b1a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785307950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307950, "uuid": "ca5326c3-cedb-4a3a-af5b-19f00626059a", "comment": "Malware payload (Efimer)", "value": "087a302bf8a57e58d5f87449ea2db325", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307950, "uuid": "2bdaffeb-65ff-40ef-8be0-bb010d5e9098", "comment": "Malware payload (Efimer)", "value": "20df2cf7270385a42b4a82122f5fd5dffb450f3f52bb483342722d0683635de0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307950, "uuid": "4b1b02c0-a79e-4fa3-8e84-69f52570774f", "comment": "Malware payload (Efimer)", "value": "1aaf2516e0e77dd1f3f5aa5fa87b1a0ce03098a3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307950, "uuid": "b519d51c-e72f-47b9-bb18-34dd42127eaf", "comment": "Malware payload (Efimer)", "value": "0c28f13c9c3b3d249bb0f552ebf4f1b924298a2bfc38f18eb57f80fb110fe194eeeeea4c85dd313a2ce9ec7b50d5f026", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307950, "uuid": "285205c6-a267-4c90-b3b4-8a858d828642", "value": "T167E6330C59E216EEEE37C23CEDA06297F66574600732CECB67A887612E571C1493E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307950, "uuid": "71cdbef0-e7d9-4c6d-bbe0-ca16c181cd0d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307950, "uuid": "369f6cd3-1791-4ace-a7b1-ff15f20550e2", "value": "393216:J4UbjTMMvopFcmsTq63XMCHWUjXycuI3/PGTAI:J4Mvlm63XMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307950, "uuid": "4301b7d4-b04f-48c4-86e8-b1afceb7955a", "value": 14315288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307950, "uuid": "60cadfbc-fae0-43e1-b7f8-1c43039cd379", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307950, "uuid": "41b7b4dc-fa35-4506-bb77-03903c6dab98", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897f8c83-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305145, "uuid": "71829f37-914a-4ed7-ac0e-5d0f74754eef", "comment": "Malware payload", "value": "9d7c669d9c4cce372d6ed0efa46a16c4", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305145, "uuid": "6f02a98b-e8e4-4113-a12f-8ed0c6083e1e", "comment": "Malware payload", "value": "21192e45f60c14b69939dddc002a9574044107db53f2896e1967bfe4b85d3881", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305145, "uuid": "0f172ddb-b040-4bb4-bd98-5653abac4ded", "comment": "Malware payload", "value": "ac6ef2037eef2a2a4a76aa522eabc99e2f38c863", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305145, "uuid": "9a39542d-68db-44bc-b2f3-1a5cd33a6a72", "comment": "Malware payload", "value": "aea2a641c31d15d7cf71026f1be46cc5ae0aa47eff89e155be6192038e0425b04da9322664dbbf2943935dc56c77c814", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305145, "uuid": "fa6906ad-b3c2-4909-a5fd-828853112733", "value": "T1EEC58E13E70DAD31C5EE4231DCBA176D6370B2DAEA0383626954E4ACFC933D582987D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305145, "uuid": "021c5e37-0765-4bff-81ee-dfef51c85d32", "value": "24576:LAhUmN2za1XXEZAQySLnVDFIv9n9iZA1lRU1cWuEdUJmVUAWg:UhPN2oXMlTLnVDFIv9nEDqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305145, "uuid": "7a288f8e-3e11-4153-9ad9-298564e5e497", "value": 2720864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305145, "uuid": "588d8dbf-4174-4ac3-97f1-f3b623a7d74b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305145, "uuid": "267828fa-5cdf-4748-82f2-614f98eba4bb", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb66281d-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785334085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334085, "uuid": "a404f6b7-b19f-4e10-8f55-1e738c5a898b", "comment": "Malware payload (ConnectWise)", "value": "fa1d0a6bce748dd794a27ee6179bf948", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334085, "uuid": "19088664-6144-422d-b4da-5bf3dffb67ee", "comment": "Malware payload (ConnectWise)", "value": "2135da1fbfb04479247c4268d2002059ca335b5384929093644e4896c44a37bb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334085, "uuid": "7b3bfe8d-d615-4eab-b118-1002a46d293b", "comment": "Malware payload (ConnectWise)", "value": "62d290cced859110aa3d507aa52e7ffb48ea29bf", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785334085, "uuid": "61f69238-6fff-4d13-88e4-9b9a83917919", "comment": "Malware payload (ConnectWise)", "value": "7077fad43f6af6e91b4f49c90cb37e34f76ed0c11564d97e90d92b71ee3d6c5a961a05cb7929899525673acd13d4176e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334085, "uuid": "0e73b29b-7301-4640-a4ad-dcfe57227359", "value": "T10746E101B3D6D7B5D07F06B8D87B4A655636BE048311C7AB5394B92F2E327C04EB236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334085, "uuid": "5adb7657-bb7c-4842-99ff-b84b07b6c59e", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334085, "uuid": "07254917-d22b-4b8c-a8d1-d45a853c3a93", "value": "98304:0zIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:0hfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785334085, "uuid": "cb4dfc66-e256-423c-994c-9d89aab61eb3", "value": 5670680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785334085, "uuid": "5bce70e6-b93b-4d46-8883-7ebdfb81baf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785334085, "uuid": "33c70ebf-cc2a-4f13-9d0c-71bb2bcd8ebd", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e420696-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324507, "uuid": "cc756d48-0663-4219-b7d7-b7ff00923293", "comment": "Malware payload", "value": "2f14d734c3f6a7596b3ac57d70382515", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324507, "uuid": "f4e22e27-8306-4efd-b3c6-d36d59487ce3", "comment": "Malware payload", "value": "234e8b3e181511af0ba6034688269aa9862f06d6898784e446d68375df10650a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324507, "uuid": "4ab4e106-72ff-4b92-a490-ccc77b2acf7b", "comment": "Malware payload", "value": "1dd3e894c2c91e2586b8d02afcb924da5cdc07c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324507, "uuid": "5248f46b-dee1-459f-99c8-b36301ead5d9", "comment": "Malware payload", "value": "caf54951c9712673770ca60d299ddcf642967dc6c2ba72fb39a77f846e847af87a42d6264d26897a95de63638721d15b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324507, "uuid": "f1f4c703-b69e-41db-ac1d-66d8ea8d1844", "value": "T12221E76B87185290F9473B79A81EF58C101EC33F10720CEF5B71F9A63522DE44B4EA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324507, "uuid": "004a5edc-e704-4cb4-84da-7873166e1202", "value": "24:9jYTltuiVwOFRxWYDwLaHXs15BlIRJiumkt+UaNuUam+ccft+H:90BtuiVxRfD9s15B2TTt+UkOlDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324507, "uuid": "34ff2774-7514-491d-9685-964ec1da6c3a", "value": 1295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324507, "uuid": "6fb10fac-4817-4375-ae1b-afa0c0b76823", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324507, "uuid": "cf2bc37b-59c7-4a79-99c0-4356c3c77710", "value": "photov_489461938126.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9397284-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324633, "uuid": "a9dd931a-d2b9-4d0f-8db4-5907f406ea3e", "comment": "Malware payload", "value": "2311e517cd16ad4e7921f04f2805f0c9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324633, "uuid": "f8cc7df8-239f-47cf-afd3-eb9fabe2c7e3", "comment": "Malware payload", "value": "244f99aee7d8cc63cca05e29ad19f03043165a8bde6ad4f21ec88cc6bafa858a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324633, "uuid": "11881775-3dc2-425d-8a0e-3f6907518a07", "comment": "Malware payload", "value": "d7eaebc2a1d2c670b7724837ae9579b196f1d75f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324633, "uuid": "a9cab385-3951-40c0-99d1-cf992da7b9cc", "comment": "Malware payload", "value": "1359a09a901793f9ff41542b7cd90612b2ea251fbbed3e80332ccaa2545a85bc97fe5563a1db4354603395c4c0e13e9a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324633, "uuid": "6d3270e1-e740-4f5f-bbd6-d56754a0cdd7", "value": "T1D631C65AAF95C172D14FECF9EC0F1216034408C51C45E3F792AA514618CA8E4AF038B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324633, "uuid": "e0d897cc-38a9-4b91-a30c-04788b092d4b", "value": "24:9/tuhHuyxWBOT3jlrppBYTQj5i8EJBIt/S4jmk3KbW3sW8xhJi37Wk1t9ye4T:9/t8HI0ppAQj5xEJuxBTz1u67W+tY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324633, "uuid": "0943f95a-8b20-45b0-8821-68bcc8e69620", "value": 1467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324633, "uuid": "303c9b01-99d5-4566-8dfe-95e02a0e9e75", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324633, "uuid": "fbaec05d-9a80-495d-bc96-2a9cbed04d6f", "value": "photov_351499307841.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee74abe8-8b67-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785341392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785341392, "uuid": "d4b0be2e-98f3-4c6d-a81e-72825c34c9cf", "comment": "Malware payload", "value": "7f2f25e2a0ef11c449e1fac9341e2414", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785341392, "uuid": "e653a2cd-5804-4db3-895d-b3b0f65b4bd3", "comment": "Malware payload", "value": "24d35d5da1d2f76292de0c6bc406fcc1108055eaaa0b54952cf8d9a49d0aea3e", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785341392, "uuid": "9bd7c8e4-2cb9-4706-a91f-dd06e06440cc", "comment": "Malware payload", "value": "4d58cacea4d27c7fb3bf89f210d30c2faca8965d", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785341392, "uuid": "2fb7ae69-f4fa-4fae-8aa2-06a2787bfaa9", "comment": "Malware payload", "value": "cf11f33bb36ef08b057371bca303490df3c686b12f2042687ef95f36fdef9fadbe33851e38b32496eefb1cb2edda14f6", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785341392, "uuid": "51acb11f-e5dc-4fad-8ebe-61f58a0b4b54", "value": "T100120A279BAB9BDC20475B242B624FD0EF9216CB7AB57600B62EFAE02750751DC85CC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785341392, "uuid": "722340cc-38cc-443e-ae19-2f60e7cefb22", "value": "192:q7j/7hMNVDtQSIjyqQWHr6YIxJvwUYF02naeT5JRTopkMWkRToR0KI/5Q:q7j/Vy9tQSImS6uPiRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785341392, "uuid": "0f60003c-65af-4b6d-af9c-4f30823778b8", "value": 9042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785341392, "uuid": "e6dc4468-d975-403e-85f8-483211f57fa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785341392, "uuid": "00c48c6a-3f91-49f5-becf-084fbacb7071", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9c4d38-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333153, "uuid": "3789abcc-c388-4dfa-9204-78afbcd8a518", "comment": "Malware payload (Mirai)", "value": "185c8d0e441af529d5bf2ba4955ea96f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333153, "uuid": "616e734d-5501-4d2f-ae43-521d03d53f28", "comment": "Malware payload (Mirai)", "value": "2536b2fabd1afcbdc51e307ed0a43928973d9bca5bb87c849b80b77370ea2ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333153, "uuid": "390b04c7-286d-4d9d-a5dc-f443187faf65", "comment": "Malware payload (Mirai)", "value": "26815bc28a7ae6b2d4d992bc47301433b10a9ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333153, "uuid": "cda7cf44-de8a-4149-9c09-ad0ff95fd786", "comment": "Malware payload (Mirai)", "value": "fd21f08c2a90908a0c7161f7217fc889b1866410449f1d15f8bcfb9374450cebbfd9c9e099b56a86eb71536f87cc10ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333153, "uuid": "6e198b90-5479-4af4-b9f2-678da8bb82c7", "value": "T102D30845F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333153, "uuid": "01ba329b-009d-454a-8f81-da2c6cb9a602", "value": "1536:UFKdzElm18uZJNb4AcFa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYT/:UFKp50zU8e947Lb71izSftBdRalKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333153, "uuid": "47f9550f-6113-4346-86f8-9c7aa07779a0", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333153, "uuid": "3666b0db-decb-417e-b96e-c6ba7aa9a22b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333153, "uuid": "81238848-3975-4ffe-9dc5-eaa0274be0fd", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6aa23e-8b5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785336315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336315, "uuid": "aa648c89-2519-46fe-ac1c-c690841004fd", "comment": "Malware payload (VIPKeylogger)", "value": "4c1ada8899dcbcde78cdbe3f0738d367", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336315, "uuid": "aa53a71f-88db-4535-963e-3cf236a5c428", "comment": "Malware payload (VIPKeylogger)", "value": "25499db3dbb4b22b4d5c22500d258732638cb19cd96f29b6eda218c3c49bd319", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336315, "uuid": "614ddd4b-eda9-4c6d-8a36-e2f42521500d", "comment": "Malware payload (VIPKeylogger)", "value": "32f8ee14cad89df46bde23e125ef9a544bd62a46", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336315, "uuid": "f6a1bef2-3310-4ca4-b778-4edada96267a", "comment": "Malware payload (VIPKeylogger)", "value": "89fb813d582dade1fe17bd265c2400b8a530e2a1279a80d01007f09bfc4e89095bac7788e86b298a9b0a80451b95c7e5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336315, "uuid": "46a3d5b5-ccc7-4396-ae6c-765569685b67", "value": "T1C3755C5EB789235A35A9C694AA5BCB7B2CC4C0121EF19F0F704D699D70EF74AA580C33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336315, "uuid": "f1f75c5b-7338-40da-ad90-af9e22111f85", "value": "192:EpCKHNX4TYRI8IbKI8+gI0Dps2lTOfEj5:EkKHHRI8IbKI8+gI0DnlTOfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336315, "uuid": "0dfcec1b-7f40-4f42-87c7-389d932a89fb", "value": 1628308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336315, "uuid": "ff3f3e1f-503a-42f0-ac5b-5ff12e9a43e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336315, "uuid": "ad3cfd37-2736-4d92-880e-344f2a04840c", "value": "\u00c7\u0130Z\u0130MLER, RES\u0130MLER VE KAPSAMLI \u00dcR\u00dcN A\u00c7IKLAMASI_img.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58e6597-8b0f-11f1-bd95-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1785303474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303474, "uuid": "ee5ee282-9a3c-48e5-9a0f-c810ab31d2af", "comment": "Malware payload (XWorm)", "value": "f7d8cd211e82f28a4ed52e1eef63a924", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303474, "uuid": "f7d8e1a9-c161-4c46-b699-bec11580a315", "comment": "Malware payload (XWorm)", "value": "255ef1d6f1da0b68446f349349d966c43ecbc96dca378836b9cc37abc013d671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303474, "uuid": "5b14224c-1199-41f3-89a9-769d34301573", "comment": "Malware payload (XWorm)", "value": "a0c93473e81e9a37cc58fdc92f270a45b6898149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303474, "uuid": "e78251bf-261c-4765-9d0b-04c04d4162d2", "comment": "Malware payload (XWorm)", "value": "5bea4d2a5c403bbd8d6eab686abd573bc8505c3434afa5e995fedbd931bf841786b82550d5805b1651db1469c3ad8ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303474, "uuid": "73ca633a-8344-48de-b55d-4f35920f61f3", "value": "T14B24C5E5B740C464C86B497A843796A7A473E64E9C289A5E38C1FF1B3D7334B441BC8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303474, "uuid": "3f5e8d1e-3bfc-4458-8b36-1ae169567dee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303474, "uuid": "99ecb5cb-516d-4515-9020-285d7f761809", "value": "3072:spi9gspoKv2ayRbgn7lBW3Q/eb+/DE9LnC0eM+lmsolAIrRuw+mqv9j1MWLQ6:O+oKv2HCT/eboY9zf9+lDAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303474, "uuid": "ef54a5e0-a7a2-4bcf-8760-71482ebd11cf", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303474, "uuid": "bb97c7e3-2e0f-4ba9-bec3-f29c1b4e74b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303474, "uuid": "dfe32c65-fc71-43fe-b36d-5bc977de6644", "value": "Mm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b563a5cb-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305218, "uuid": "7fb0cf64-2ef1-4be3-a7d0-f3fc58048f27", "comment": "Malware payload (Copybara)", "value": "c2965b1f7a94860a2f982d202f7f6d58", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305218, "uuid": "103a7e8e-b4d5-4df5-a264-f6b001784ad6", "comment": "Malware payload (Copybara)", "value": "25e6a6bac0859c785063eed88c04cfbb1c30613c9b549d846d43d1920db172e9", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305218, "uuid": "be61ae36-004f-4044-bf7b-2d386b6ae190", "comment": "Malware payload (Copybara)", "value": "0001da6a2b92bef1607d7bdb6f471198a7c08e20", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305218, "uuid": "1d78e64b-2eab-4d01-9cf8-04a137d9bd5c", "comment": "Malware payload (Copybara)", "value": "0d04dc9fde67aba780c938c8ceb09840e4b33426813aaddefa129ffbaa88397744550595459ce8dc558f31ed05ec38e6", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305218, "uuid": "f817ed13-7e4d-4574-8514-7886d2df59b8", "value": "T132A63352F31A6F0AE2735732C866926824733D0A8F734267BE5273BC54FA1D04F52EA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305218, "uuid": "c8bcb5d1-d437-43d3-ab6c-f98701a4046b", "value": "196608:OjrSDM1sFO92upDjg1wWwPLCLH+QN4ut1eMSk9QObbmlfMHOchwnNVKQY9Wu3KB5:iD1592uy1xwPmLH+luHeFOQObiZIpwN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305218, "uuid": "60a6557c-2d47-4590-8736-c94e502084ae", "value": 10353470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305218, "uuid": "d533e25d-0176-47c7-8074-e98b21fb196b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305218, "uuid": "7a3a39ba-7be1-4eb9-ab8c-33d431c8caad", "value": "25e6a6bac0859c785063eed88c04cfbb1c30613c9b549d846d43d1920db172e9.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd289831-8ba4-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemoteX)", "timestamp": 1785367562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785367562, "uuid": "6aa1e7e5-fd54-4c94-9f4a-5f1cb4189bdf", "comment": "Malware payload (RemoteX)", "value": "70167040a63143a7130cb17e6d3c50ec", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785367562, "uuid": "b49bf26e-35b0-48b6-a83e-987dc2c18f47", "comment": "Malware payload (RemoteX)", "value": "26cba7929124eb13801a4e32c7071a2b3ab10896048bb25ca900e04edfa34795", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785367562, "uuid": "1f7d7ae8-2e25-44c4-9646-db7cec37bf69", "comment": "Malware payload (RemoteX)", "value": "04225100608ee8c6edbc417ab3d5321a88f4ef9f", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785367562, "uuid": "cc8c43b2-b156-44a7-ab85-083ba47c5ad4", "comment": "Malware payload (RemoteX)", "value": "eeb824a1952ceef53676d0ab04c907907de561c7761ea75053056a1d0c3272ba2a71f627b322633b2a117698e0f41bbd", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteX", "colour": "#146CE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785367562, "uuid": "fd15066a-3715-4181-a8db-b491e97bf9cc", "value": "T1DEF65A47E8A545E5C0AED175C6269212BB717C884F3063D72F90FB282F72BE0AE79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785367562, "uuid": "3d133d6b-2e79-4970-90ce-917b51b8c55e", "value": "bf3d0d0ac28688e113006e8b183acf31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785367562, "uuid": "51a1b64e-3f9f-4259-9a53-16efd432a944", "value": "196608:upy44hK8zWJrtmM7oqUJB0HXZ97MU8J1Vq:uY44hK80rseoqSu7MU8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785367562, "uuid": "59328533-907a-401c-be53-61ea7fa04066", "value": 16446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785367562, "uuid": "192b2c4e-3307-423b-978e-2b82b1fc42b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785367562, "uuid": "1719bdbb-8ac2-47ff-aaf4-38ba1f26c536", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c850f6d1-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307398, "uuid": "b12c9e84-fe60-4761-9e57-3908151f2910", "comment": "Malware payload", "value": "7df273f3a1a3c6665a7f73546c640489", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307398, "uuid": "28ff9614-e63b-4301-b340-f7e3b943ecbc", "comment": "Malware payload", "value": "26d86f12a92a23f45deefabb67d252d562313f75c1a82f0b499bf751d8ae37bf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307398, "uuid": "730aea76-6d1a-45ab-8173-d70b796beaa9", "comment": "Malware payload", "value": "20c52abf02bee9042b20cd9fb41f194f1fb686b1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307398, "uuid": "5f9d20cc-05ab-463a-a0f0-0e39b6886e6e", "comment": "Malware payload", "value": "bcb9d17b0624aec04e8248a64143deb621995082da62628fbb109aa0278f05bd6446b4d4c308a1a3e85c36130839158a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307398, "uuid": "1525f55c-89d5-411b-916b-be707ef1bdd7", "value": "T198D18DB77506467A58EA5CF174744CBF461FB0720F2C7503F786E2A929931A049A4FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307398, "uuid": "97e04ed2-f190-4b82-9452-6ca50fb17d59", "value": "192:OzRlMXbe+fzMEJ33VX9+MJjGOg5xKhIqZe:OjMXbeazDttljGOg54K/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307398, "uuid": "ef148053-e386-45ad-8eed-114af019f3c6", "value": 6352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307398, "uuid": "d3ac13cb-e685-4bc2-8e90-f01409a4539a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307398, "uuid": "f5f32ff6-e82f-4686-b6e5-056ed9fe3e68", "value": "images_20260728_092148.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458d4a7d-8b76-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785347551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347551, "uuid": "22e17d99-33b8-427c-a454-79d17a0753d4", "comment": "Malware payload", "value": "63951c4114bb7b172c40a8d72f1571eb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347551, "uuid": "64df1e7b-b772-43fb-bb65-501637005662", "comment": "Malware payload", "value": "27550b8c15c5a7cf5568dd1d2e1243b510eb983a7eb8ff5ddc9974415e5a0093", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347551, "uuid": "01c179ab-00dc-4fad-9a03-f89b9d94b56f", "comment": "Malware payload", "value": "58ab34482258c4b7f1c8e1f7e5b71d93060117a0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347551, "uuid": "8c019202-e49b-4b15-b067-0ff863d4ef7e", "comment": "Malware payload", "value": "8dcdccab0de1af29fc93a819cbbfd7830e6735e76f3230dfc024267451fd483fc5deb5f39d46e940a35c5a6db907e27f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347551, "uuid": "d010cbfc-d0e4-449b-82cc-750ad261aebc", "value": "T1DFE6331858D022DFF6B7913CEDE251D2D8EA74F32772C6AB43B44661AE172D08D3E642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347551, "uuid": "0bfc17b9-1f31-4143-b88c-9ff2a764127f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347551, "uuid": "7aa044a2-b978-4381-bb3c-e976ab4f3a52", "value": "393216:ZNPPdzcPizdFofXMCHWUjXGcuI3/PGTAI:ZxaPizdFSXMb8X7H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785347551, "uuid": "9285a381-e0e6-4824-9a0d-b9d0dd709e53", "value": 14288138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785347551, "uuid": "824ace6f-1fcc-436a-ad18-379c2aad2328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347551, "uuid": "3ad149eb-4ca8-4132-a223-2e45339ed3b0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fafb09-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785332915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332915, "uuid": "4f9bdc16-5420-4206-b605-fffea5531753", "comment": "Malware payload", "value": "ad6770015f907381b45691bc465859d3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332915, "uuid": "343f04bd-1fec-4dc4-8529-73949e5e98b6", "comment": "Malware payload", "value": "29816ba7d2b19508e688c572c98297150af0c4e62cb41cb78e6cf33578525989", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332915, "uuid": "1cefa74b-dfd2-4068-8728-af37b8c1014a", "comment": "Malware payload", "value": "916a3aba4c915da3fdca9d0ff863c9cdd8fdf559", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332915, "uuid": "b74776fb-5912-4ef4-bbee-056f3c058248", "comment": "Malware payload", "value": "20118bc6136b8baa74729ddccf571ea9ed9bdcb5015fa02f3b21130ce44efbe54f74343582bda6d4bc60d899044d4905", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332915, "uuid": "3a441851-5861-499f-ab73-70303974caab", "value": "T16581106BE37063B03A1A876D5A8F4179AB85207F04187E3638AF39017F49559A1F3A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332915, "uuid": "1ab49258-6870-4900-a266-e331d8fc17b4", "value": "48:uv2PUUscDiiqz67cifDNfm4fDc6tTjmI1HUQ4Uk4g7ykgQxJAUkl5mpZfxdFSmSC:uqzgylyoeTxnHqqphV6/2IK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785332915, "uuid": "76918336-518b-4c26-8d69-8cdb8a524b2b", "value": 4140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785332915, "uuid": "f8968757-cd41-4276-b9ca-20475351a1ae", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332915, "uuid": "39458c76-4329-4380-859c-bdfa65ac60b4", "value": "setup.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea61d7a-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352962, "uuid": "243fc8d4-2fd4-41db-a16b-d0398d03da75", "comment": "Malware payload (Mirai)", "value": "d643aa6bb955919a965eeda5fb897faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352962, "uuid": "789c210a-e4a4-4c2f-b33a-da416cbf59e9", "comment": "Malware payload (Mirai)", "value": "2ad53cce04d81baa4eb732c88d465743c45a5ef4349d71d18759f715848c8f9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352962, "uuid": "2fb500b2-c302-41b4-aa85-3ec8c4b47eb2", "comment": "Malware payload (Mirai)", "value": "4cf9d0feb89137944454e13eaadaf34ff8241d6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352962, "uuid": "20eece83-9ef0-42d7-9a56-77726e91073b", "comment": "Malware payload (Mirai)", "value": "e5e198fd6167d7f5e416d6203f1bcadf891f4a7079f8aed895fdd803a7d0a32b9ed6fdc3a48ba8d47f4f56c986f34e52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352962, "uuid": "e68f0e0c-693b-499c-be23-3b5b277315c8", "value": "T194D30945FC445F57CAC225BBFF4E438C772A1768E2EE720399256B60378B85B0E3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352962, "uuid": "b53a7d42-1037-43ed-bab8-f4fb4c24b98c", "value": "3072:nsy+Achgd7xDbCxwx6ZzhSgNIitth+UFN:nO6F1bCxwcZzNIIX+UFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352962, "uuid": "d746dd28-3423-4146-bbd7-45983c3ab48b", "value": 137080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352962, "uuid": "b4acb1c0-2620-4ee0-aab1-396e4220aafa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352962, "uuid": "b8584300-92fb-488f-a5e5-6090ece1a232", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be934869-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307381, "uuid": "9a91438d-90d8-4554-a287-ba0f83deb573", "comment": "Malware payload", "value": "00e16bb013ffc3dfd51898bf8d24667e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307381, "uuid": "dad2ef7f-1f82-406c-a83f-3b9e26865502", "comment": "Malware payload", "value": "2b7bf07e2fe98d16055d48bdd662aad581de186ad345d690bbb73145cd1b20d9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307381, "uuid": "e8e20444-80fd-4609-ba0b-8d302f5d0ac7", "comment": "Malware payload", "value": "2c91c2ea15152d707b3cb6573e6980589664a54c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307381, "uuid": "3efb8308-c24b-4e5f-a368-c6b1fe5be872", "comment": "Malware payload", "value": "5f4081a87bbb2db2b89393cd3844c65b239fe5eaec4db0cf3f3357c11edb3c8aa30a9647f81b3ac73ce069709f8286e8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307381, "uuid": "d768c8d5-98f7-48f0-a7d1-9dca0ea0df0d", "value": "T195E1AEA9A3746A41F81FB33A221B0C0B1B3251A3A51462DA57174F98217E43D678FF3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307381, "uuid": "4ead231f-8294-4f78-8222-b08a32236a61", "value": "192:YbGWTm9KZX92uw2COQXb4Tb+P66PGMuGBrQDs:kTmA7COQr2ybPuUrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307381, "uuid": "b86d2dac-11a4-465a-8406-13b4b7ce3cd8", "value": 7284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307381, "uuid": "8135de0f-9f22-4fa0-95de-019a3493233a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307381, "uuid": "2e125c0b-6402-4510-af24-b4caeff68dd1", "value": "images_20260729_051640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5394626a-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333401, "uuid": "8e06b96e-56ba-4050-b871-ddd76304d1b7", "comment": "Malware payload", "value": "71c24ebd1726ae290705480568d2864c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333401, "uuid": "a51eeb7f-a728-498a-8798-a5e9e83e18a8", "comment": "Malware payload", "value": "2bcb88f4c13902767dba8f908dbfce453d2ba230b1712585909fe2a945a8e438", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333401, "uuid": "06483c24-75bd-43d5-b0ea-243684b3fa09", "comment": "Malware payload", "value": "d29cad86ff64347a1c43b5b92b0bdc19d3b7107f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333401, "uuid": "a5708c53-dbfa-437b-8575-4f887c3e6ab7", "comment": "Malware payload", "value": "c35e8ff859ef54b616f82e244d2887939ab02b06c666ed25580aa570888787fa326169f191d23181e0094cf8c372154d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333401, "uuid": "0d7fb74f-5b0e-4d18-bfe0-265d3db01270", "value": "T150A2B5E3B29055217013007DEE2E6094BAAA746702880E34B5DFA53A7F584F8F33FB25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333401, "uuid": "90677e26-b05d-4bf5-b81f-9b6ff489b1a9", "value": "384:zxHPU/uanbrs646Ayc6o6JtrdJF7QFHDS:zxs/uanxtrdJBQNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333401, "uuid": "95e2eda9-b111-49d1-8add-ace5e2f5a6a9", "value": 23348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333401, "uuid": "e4e6f8f9-4c57-466b-b201-c29db990276c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333401, "uuid": "556bd98f-7ee3-49ea-866e-2c7da863b9da", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e067659a-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307438, "uuid": "09ae31cf-62a5-407b-8136-b346a289e7fc", "comment": "Malware payload", "value": "ed95d2b94cc65c2c075e7c0bb3f49757", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307438, "uuid": "5d458016-1978-46e1-8724-40cbadc604f1", "comment": "Malware payload", "value": "2bd862a47885cbf30f4b9b454a8fb7f768dde815c3c347b9bb7958e72df4d48f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307438, "uuid": "e954386c-142f-4ad9-834f-bb79353161f2", "comment": "Malware payload", "value": "10c9b71da678abb7b1688aaaf2b7c3e98c4e4d47", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307438, "uuid": "09bde14a-9d46-42c0-8795-5ce524de6a6c", "comment": "Malware payload", "value": "3b4042e3eefd3016cb0039751963d0747480c24314f2f4cec213119c276cbf7aeb53d82788323e70dc7959fdabaffaff", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307438, "uuid": "7f53205a-ca68-4dfe-b016-cb8a690735bc", "value": "T119717C3D1C8A9C35C5F65E732AE219EE432A1BBA41E654E288E59C0C1B931EC0043E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307438, "uuid": "e8398f2d-6c1d-4244-87e6-67e641b32215", "value": "96:VAhlBds5ezDwc7GWt2+9Rc3CAXd0Kt37LM2q8utX:GlBeq6WPSCUH37ByX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307438, "uuid": "e30467c1-6c2e-4a9c-ab4d-9be9515369a8", "value": 3714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307438, "uuid": "35ab0633-0b37-47b7-a0f5-e244d7f97d21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307438, "uuid": "5e93f365-aa6b-49c7-97de-0b0f72d3ba87", "value": "images_20260729_025327.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18d5a4-8b2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785316314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316314, "uuid": "78916cdd-f2db-4c15-816b-0359bb53f12d", "comment": "Malware payload (SalatStealer)", "value": "24aee3a61aecc5ec58375d838322010b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316314, "uuid": "3f680fb0-df1f-4749-9944-3a82a19e471f", "comment": "Malware payload (SalatStealer)", "value": "2cc5df961162f8f9cea6273cb82756ea591f1d5ee62ee5cd0f19bc12cda7b7d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316314, "uuid": "7b2105cb-d0e5-4f84-bd6e-894aab64c2fb", "comment": "Malware payload (SalatStealer)", "value": "ebd767d125e3d336657c2c6d1d06ed3089e19d02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316314, "uuid": "c71951f9-c075-4746-ac6a-c0a4bf30f056", "comment": "Malware payload (SalatStealer)", "value": "0e58ef652fa3f4557cfc304e3cde560fd8d70b4c8226867a88ffcef18f7549b971907f1214b8585ee10cfb176892aab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316314, "uuid": "1883f9eb-0c82-4587-8692-237a5f948374", "value": "T140C66C11FACB54F5E9035831406BB27F23315D048B28DBDBEB183B6AF87B6A1197A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316314, "uuid": "fed24441-62b7-4d25-a2a8-09cc541a8df7", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316314, "uuid": "59e0909b-a575-459b-8d51-95a5fa3d0536", "value": "98304:8UhSHKu1UL+2iy0NeDqgtBt4bc3HX+LElO/:Vu1y0opHtDhlO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785316314, "uuid": "473c9576-b9b4-4c63-9a4e-fd01f742b778", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785316314, "uuid": "12c0b945-96cf-49d8-a5ca-ba5a8a71aa96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316314, "uuid": "87764236-4a81-4c0f-9365-28014659daea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74017e84-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Chaos)", "timestamp": 1785333026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333026, "uuid": "19cdc303-9bd1-48fd-ae71-bab1c3ffa799", "comment": "Malware payload (Chaos)", "value": "8295e858eaa1d0a69137e105df6dd690", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333026, "uuid": "c4b4b9e3-65a0-460f-9e67-a76459bb0179", "comment": "Malware payload (Chaos)", "value": "2d8b09556b0e45a68e466079e1b3e9446c94d3e671d84aeef4ea5c200d8f6255", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333026, "uuid": "256b26b7-cd02-4f40-b049-5870ae466de9", "comment": "Malware payload (Chaos)", "value": "56397acb2f138d61feba218c6207c684ce1da84f", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333026, "uuid": "06a9fe60-5f41-4cd7-9047-8b31072ec3cd", "comment": "Malware payload (Chaos)", "value": "429dcd953048d158929a70dd78a171997b85bf8862b44c7def1a1fdc3dda61545c58cc4c6828e264838e8738671cf66f", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333026, "uuid": "54b54b2d-f76e-4bd0-b999-4dfb7ab57c10", "value": "T173363A57EC9586E9D0EAD1308A629252BB717C485B3123D72F90F7783F72BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333026, "uuid": "ab568657-a1ff-478a-9a67-f9b5258d4be4", "value": "49152:FGKPMxchyyTrCXDMrTZ3+tVNfEP2KmpAX5EWOigY/zA95xwR:TMmhyyTSe3+BnUExvxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333026, "uuid": "d7af1010-a057-47c6-9c88-aec902ccb2fd", "value": 5234688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333026, "uuid": "9255257e-59d1-472a-8240-7d3fa27af8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333026, "uuid": "29739c82-99ab-45f7-92f6-8fef616e47ce", "value": "amd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2380e9c4-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323872, "uuid": "a468f705-4757-4575-a52a-bb1c3a3928bf", "comment": "Malware payload (Mirai)", "value": "aa910cb758a60a57e4a8cae5aa6749a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323872, "uuid": "a7f66a33-3b91-448b-85e0-6d2aabe47eb3", "comment": "Malware payload (Mirai)", "value": "2d98b44c0532415ce47394f90b47da593c0619b21b486dbb80727d05498eafbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323872, "uuid": "3c7cfc71-1150-4dda-90f7-6c6f20403cd1", "comment": "Malware payload (Mirai)", "value": "3b27b153d858a48357bbd826a416be47889b76d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323872, "uuid": "e90c29b0-786f-4495-9feb-05fc40b28705", "comment": "Malware payload (Mirai)", "value": "b3ce632ba4182802647f85129b1f46585bdf2d5acc4c837e5152c4ad1ccee05c1055194c257a1c29884c8a7489a16c2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323872, "uuid": "d083c89f-18e5-4381-8a32-298f228ecc86", "value": "T1D1739D76D0786D98C5148A34A6A8D9B88B17A404A7A37FF2C6C1CF654047EFCF2147FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323872, "uuid": "9762f91b-6d02-4753-8ab9-dfe7f60c7fd5", "value": "1536:P/kM1DnBApwt1N0Haa+9mUESf9RwUhKtH00lRCi8v:PMMxnip4cxS1qwUH00D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323872, "uuid": "9d494ad9-3346-4adf-8ced-014c3d7e7ba9", "value": 80596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323872, "uuid": "61c5d23d-072e-4445-ba48-bb72f0b7c269", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323872, "uuid": "9268d8fe-062c-4fd1-b4e4-ffd65b10eec9", "value": "MMaaRRiiOisecTanee.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "517d99f9-8b8c-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785357020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357020, "uuid": "f81e6659-be57-412c-bf1e-d7e25d8cf5d9", "comment": "Malware payload (RemusStealer)", "value": "5f9f58a97a8fa8fdede17725cfd8d08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357020, "uuid": "f029da4d-17d2-4afe-91f8-bad0a826d1a8", "comment": "Malware payload (RemusStealer)", "value": "2ec31f7f0ed881a6f33f44be53ddc89fff6f5f80390504093ddb4edccb46a830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357020, "uuid": "d8af932b-0957-4e8a-8f3e-66265f57b11a", "comment": "Malware payload (RemusStealer)", "value": "a46ce78b4c02141abd95cb3ea30453328fc01dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357020, "uuid": "4e70c5dd-9a7d-4a95-b51a-16ba987968eb", "comment": "Malware payload (RemusStealer)", "value": "ed13622796e9839b86fedb85fa35b8f0ec540f95b745b1d2a79630bc3730257417b743826ea0b593554224e148606a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357020, "uuid": "8de6924c-27d9-4b03-b5a8-705ca2476895", "value": "T1F2C55B47BCA119E5C0AEA2368932518ABB71BC441F3223D76E90B7782F73BD15C79709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357020, "uuid": "8bbcd265-eb53-41a0-a405-afda6af023a8", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357020, "uuid": "014a8f7d-53f0-487c-9e15-242896d5b90e", "value": "24576:0t00usaJ7iN3f1Z8pHeeEC9uESRLnJcR1hCVrjbUXMdPm2LQuGWsbAROL2OG:0t06aJ7ix1ZneEMu8krjYX+59OL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785357020, "uuid": "f863615f-a9f2-451b-8aae-2052aea05495", "value": 2516480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785357020, "uuid": "df26aaf6-0352-40e2-8512-6556cf08aa97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357020, "uuid": "49c61252-4839-42ea-b7d8-026cae7b600c", "value": "MicrosoftEdge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c456064-8b59-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785335214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335214, "uuid": "aa25d197-1aa5-4182-b075-d7b86fcf0843", "comment": "Malware payload (Mirai)", "value": "33b3d951f322345d23142ccbadb516ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335214, "uuid": "09c8086d-671a-4600-a2dd-347e237fd1d4", "comment": "Malware payload (Mirai)", "value": "2f7ffce5d02499ed4f3801aa1433ce0dad003a1ab818659a1994da2059c942ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335214, "uuid": "1f305797-b05e-4a11-98ac-80501a34c6ca", "comment": "Malware payload (Mirai)", "value": "9cdd8ff1181770100719ff2f167d0032e876241a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335214, "uuid": "dc92cd20-495c-49b6-a1aa-1db92278b7f4", "comment": "Malware payload (Mirai)", "value": "275c4eb9a9ddb124977f70b3aed4b823914b023ec3f7e7bae7a55a23f60fd16fdb8f2222fc2dcc5866657192d34ad2b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335214, "uuid": "5cb7f0a2-edc5-455b-996c-0a7c580fd3c9", "value": "T147E37CB2E8356E6CC171C578A0358FB41B23999552430EFB25B6827510C7DAAFB1D3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335214, "uuid": "7f949143-0c29-4d76-a439-89b709a61ec3", "value": "1536:g4aqKPI/gI9Y8uApmuDlCouK+WTR/yxSZs6FtWxenCuga7Xa10rb9EJ/a:g4yI/lW8uApm+RB+lxSZ5tWonCur2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335214, "uuid": "30266c54-5802-4ab5-a630-040a7f357988", "value": 155652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335214, "uuid": "77515a57-21e9-41f1-8fc5-59ed74c54706", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335214, "uuid": "46a1cc1f-1c6d-4b58-9895-8f0ea8778e2a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c3106-8b87-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354762, "uuid": "c27fb072-b875-463e-8178-99f127afc3e8", "comment": "Malware payload", "value": "981ea5de867a785979783b1f13235d2a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354762, "uuid": "83e88dfd-44c1-4288-a0db-f63b94bd8697", "comment": "Malware payload", "value": "2fcaa054ede7ae263d4479c83e122bc124b2c78b768ad653eb4511a95360fd3f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354762, "uuid": "d217ed6f-2d08-436e-9394-771b973ceb0e", "comment": "Malware payload", "value": "b06bc16b1b54ec93770ca8b47dc319f5f690dd9c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354762, "uuid": "ddd6fc1e-d568-4bfe-bed9-8448ef350c32", "comment": "Malware payload", "value": "eab2f6cdabc214459b6541f09b42fc71daa3304151262f10ff917847f7be08396ed3711f217750e20c0f51498d48dae4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354762, "uuid": "583a28f0-26f7-48d6-8f3f-84fe7f7e55bf", "value": "T118967B077CD108EAC0AE933189A65661BB74BC084B7573EB2F60B6392F727D19D36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354762, "uuid": "1c7dcf30-b061-4a2c-b384-cfc9011f5a09", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354762, "uuid": "f79f81f2-cadd-46d4-87a5-829969e2dcd4", "value": "49152:OcUw5AgCHAlrZCUVV3BCJ51pwY5hJkzCUbEE7WmK:OCLTkwYjy2APo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354762, "uuid": "ddeebb1a-8a12-422d-ab61-2b2923557223", "value": 9365880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354762, "uuid": "9b110775-afb6-482f-a0f0-b699eef9d36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354762, "uuid": "7d79f21e-719c-4430-b796-7c579a5eb866", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81140160-8b0e-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785302983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785302983, "uuid": "96ac77db-23e2-4d59-87be-18b8637b2f6c", "comment": "Malware payload (PhantomStealer)", "value": "83573ee054170a0e7ec9ec77d38a5361", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785302983, "uuid": "05f14b12-2312-40bf-8348-d7b195b84a77", "comment": "Malware payload (PhantomStealer)", "value": "2fdc032584f04cda6c12f7d6f54cdbceb33484b1eb2cc98a5ee8ace40fb016a3", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785302983, "uuid": "8450b0cd-568d-44a9-9cfa-9f6a18a33f3b", "comment": "Malware payload (PhantomStealer)", "value": "ade0762017ce3432ff2b2c9c80bc756d5cdeddcc", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785302983, "uuid": "92fd44fd-b880-4acf-9b91-4e56dda154d3", "comment": "Malware payload (PhantomStealer)", "value": "335fb09d3fb85cd24c44cfc08385d4bf1ad8b6c4df799804f893b6acd2f6e825978a9dcab5960adfebd5f9dea3e994a0", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785302983, "uuid": "cf8fb653-e5bb-4741-80e5-07de70e13e6b", "value": "T1F272E006571E1AFCFA18299C75F38DE90DD5FFE8B51DC6C7AA0263F41E51294E680074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785302983, "uuid": "2070fc70-2bf9-4458-a82c-6b6ca3466adb", "value": "384:vbqD/f9QITQAP2XRlcbOThN4p0fdVKZ5wyflZCr4xOe/QVi9:eD/fKITVPuncQhapMVKnwyfTJwZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785302983, "uuid": "ec934e22-56e7-4e02-a57c-7bf8f9dd8fdf", "value": 17419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785302983, "uuid": "fb87283a-7c2d-4c99-801f-b6a08a1fd25c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785302983, "uuid": "81742205-ec2a-4221-b00f-a520de25c812", "value": "PO-MokkiHub-un2907268.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592f5382-8b1b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785308500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308500, "uuid": "603053a3-ba1a-4d30-9aa5-1304f44efd5c", "comment": "Malware payload (Mirai)", "value": "b687068ba371132cde63616b9af27683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308500, "uuid": "b919caa2-8106-41af-a004-c8a0994b5571", "comment": "Malware payload (Mirai)", "value": "30788d7f420b84cf1f32fc63704e7fd0bbf044135b9f19d139a669c669d3ff59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308500, "uuid": "e168bb78-25a2-4856-8997-72c8ec883e22", "comment": "Malware payload (Mirai)", "value": "dcd27759e8eb8a8d8f25f9bb8b06ab25b2d9b0c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308500, "uuid": "c29926ff-1f0f-4b9e-b1fe-e34ad441f20a", "comment": "Malware payload (Mirai)", "value": "a5a144a059dff0414ec13176a36feb765b7479bd2724ab3c1b56c53d4cd1795ca24ba1894c2717db012c7ce167d2a505", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308500, "uuid": "de242566-dc41-48f4-b3c2-cab37f32e20a", "value": "T174F48D2BB2B3B07CD01BC03047DBCAB25536F47522212E7B26C4DA353E96DA5276DB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308500, "uuid": "4379151d-a432-46ab-ad3a-0bee3cf120ef", "value": "12288:/ptqBJUBCua77wNg68pJFindiHOwvU0i/PYVxnayUwxHX:RtqBOanwNgZrF1zi/QV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308500, "uuid": "b4a6340c-7596-487d-b8b0-7497aff360e7", "value": 743536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308500, "uuid": "37801176-4048-47f0-be23-eea93f3da2ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308500, "uuid": "24a64f22-427f-4b28-b964-60ac3f300aa7", "value": "bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae58653a-8ae0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785283302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283302, "uuid": "470f6d49-95e9-4121-870c-109fed5cb174", "comment": "Malware payload (Phorpiex)", "value": "d4a15cdf5b5324ab79e610ced133da8b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283302, "uuid": "696e7693-4c42-4caa-aa41-629ffcdde7ec", "comment": "Malware payload (Phorpiex)", "value": "30793394a8638778432c95d8c121b00f7a4c64226588d1a5d2538bd62f3b187b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283302, "uuid": "b60b0b93-0ec7-4247-8eb0-bab6c0f6628e", "comment": "Malware payload (Phorpiex)", "value": "6558d352c7dcce247b385127d29e7e280db5a5d6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283302, "uuid": "51d17f97-8174-447c-bda6-5416305f43e5", "comment": "Malware payload (Phorpiex)", "value": "b34963417ac028c4a44254e4fff3682162c388311fc3f734e1f8ef314519d7086a003ff99a7f5887267b70e765901003", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283302, "uuid": "56b38b89-4e7c-40ed-891d-fde92fb018d2", "value": "T18A624B0BA4808035EBF14474927F526644FEACB623C1F9DBF7E0688A4AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283302, "uuid": "78a06af2-fa0c-45f0-98b5-6ba430be5715", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283302, "uuid": "c76bf5bf-e40c-4e62-b40b-893997ceccd2", "value": "192:AW5sGnjXgjk8LcRI+IdJDMBIfeF5oIV1BKUSfEzQ0X1d1gJxTmv8U9cthY9ik:AgScqpferoFEH7yav8U9cOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785283302, "uuid": "fe1834db-b5db-4052-a329-e8886c7d4e63", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785283302, "uuid": "dbd4d418-0618-41c0-84ca-0bb4d7320d12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283302, "uuid": "4a6456e9-3428-4b65-b640-39cfe2ecc27b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee1ea4c-8ae8-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785286820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286820, "uuid": "c27a92b0-055b-4e82-81fa-f075f0b0973f", "comment": "Malware payload (CoinMiner)", "value": "2c735bfeb6d34be3b8cd6008476541d0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286820, "uuid": "a899fcc8-94d2-4ff4-8573-574ab6a13f8a", "comment": "Malware payload (CoinMiner)", "value": "30cf8b82a53fff20b564597e56123ddeb16a87441a8b94f621e52c3213aeaa2c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286820, "uuid": "3acfec89-a2a9-43bc-a3fb-e166db82ec32", "comment": "Malware payload (CoinMiner)", "value": "513401f23f65a63d0e7754118b56edb06c9ad676", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286820, "uuid": "7955a3bf-3b9a-4ddf-bfd3-b8e0c6732c0a", "comment": "Malware payload (CoinMiner)", "value": "951254eaa1651f3da42a1b044ec7690057886acb59da67a2c0f51ce6084814e7cbd0ccbf17e0f23cb90456f09905a2f1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286820, "uuid": "1c18da68-506b-470e-bf3b-9d82d12a533a", "value": "T18C220A197E8A0332E3A048F45479824B543E5533E787E3EFF373959A4A963448850EBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286820, "uuid": "15bb9b1d-64c0-43f1-b1ad-c3ceaa0289db", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286820, "uuid": "2fe5af69-54c8-4d62-88f8-2a98e1bdf4ed", "value": "96:CYdFo2Yz/J4h/wQBDB2dyaVDL1x+ZQ75ZTMwmmpPFJxGE9mZ2FFhxC7tCEmJe:CmoFeJBDBgx+e75tpPFJxTEZmFhSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286820, "uuid": "741aaa1b-3d08-4dda-8560-5dfe8ae09d1d", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286820, "uuid": "8e868374-2960-40e6-8dcd-68f3ebfb3559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286820, "uuid": "a4d9d1b4-65b7-466e-bda4-cb42147de75d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4795c5-8b21-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785311132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311132, "uuid": "ca6b55a7-7036-4a48-8bb1-d57aa161d7fb", "comment": "Malware payload", "value": "382cee212140df012150595bd32aa01f", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311132, "uuid": "4633f312-5d3f-4d7a-b21a-306624a91905", "comment": "Malware payload", "value": "316a011169a7b30844d28b1e1afd0add0343f8310464ef9410569c8b12929068", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311132, "uuid": "33c918b4-f591-4963-b7d5-b9bfdce4927d", "comment": "Malware payload", "value": "716c11e4eee29ecd7b964924b926d2f6ef9b779b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311132, "uuid": "c539b50b-f026-44ce-a2af-f7b00048263f", "comment": "Malware payload", "value": "154c1f6a1f4760021be044e60a4948da71c3cca223ce8da4931d561dddf4668f687e3082b0c3f0c4843bc656c105667f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311132, "uuid": "c9e88074-1566-49e7-be8f-0c645c6fe157", "value": "T17E06AD07BCE188F5C09AA235C97666927774BC584B3137EB2E60AB783E723E09D35741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311132, "uuid": "3b902896-2043-4204-98de-9494331b17e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311132, "uuid": "40578642-e5d5-49c0-98d3-78fc9e59838b", "value": "49152:T1ZvDJ1DrbCLhYtVps8TJUIEB/ZSVVOuEUNIIv1N2CMh/zsnYmBpD:TDzsDGVOUN9v17w/wn91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311132, "uuid": "3f91f468-b174-4795-b401-7ae68026ee33", "value": 3833688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311132, "uuid": "cd3f0fcf-51e7-4c44-af0e-7fa7fee591fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311132, "uuid": "00dbe32b-2bb3-4118-a4d2-f61ecd73509f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e503c0-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Ladvix)", "timestamp": 1785333034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333034, "uuid": "8e629aa0-2930-42df-817e-63106f4ff22c", "comment": "Malware payload (Ladvix)", "value": "3b503288969cd0f87f426d32e1f46ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333034, "uuid": "372e794e-3f76-46a5-ab14-679f278084c2", "comment": "Malware payload (Ladvix)", "value": "31e517377c8a025ddd0adfb0558707464875187624981204e00f62a34353bc76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333034, "uuid": "e90c2d73-a08b-4c55-8904-b49d86f7f24a", "comment": "Malware payload (Ladvix)", "value": "cabc9af1e315c19da7e54c90bbe59ab2ec4486f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333034, "uuid": "a045a17f-dc32-4f84-84a2-f1ad24462d9d", "comment": "Malware payload (Ladvix)", "value": "aedaecaed4f84ef705e611786d186767a00cdbde238b4802412b5ecfa96e968356b7fabd7970564bf156e0352b084db7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333034, "uuid": "1247f50f-b8ac-4bd9-83bd-9b9ee3176e23", "value": "T191955C5BF2B364FDD19BC030479BC7A3A831B4A512313D3B6684D9351EA2E601B69F72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333034, "uuid": "f7a6f64c-df2d-44f8-a27a-47388c424cd4", "value": "49152:6usNZujYgD6SVv6B5IIOqdMaPv/vYo/QQ:7sNMX6S+OqdMij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333034, "uuid": "e7a2b3a1-f609-4e41-aa5f-6fcd32b2ada6", "value": 2049687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333034, "uuid": "adf10c45-27d8-494a-884c-ab89d38c110a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333034, "uuid": "f98be627-21fb-426d-b9a4-464e6212564f", "value": "bss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850f7c11-8b31-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785318022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318022, "uuid": "fb79636e-23ef-427c-ad70-97a761a08863", "comment": "Malware payload (ValleyRAT)", "value": "1e780a793ee1c9cb30f9dca02c91390b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318022, "uuid": "15bbbb2e-6aef-4ffb-84d1-9317c2ad7cc2", "comment": "Malware payload (ValleyRAT)", "value": "324126d263910469357915525f2637ec1b0a2a6b875399b96c979687fed86e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318022, "uuid": "e2e4c5c8-d3fd-480c-8683-2dc0f54f68ec", "comment": "Malware payload (ValleyRAT)", "value": "1acc53992476aeaf034a4ab1c7852f69863a2fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318022, "uuid": "1b8f9c92-a47d-4448-88fd-aa6b98667480", "comment": "Malware payload (ValleyRAT)", "value": "c75edc4cb3c41c642cefde743a1d881789924bedab11d7b422eb7d7e1fa4167e22aa56776ce55b2e695b1b7c9366b7a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318022, "uuid": "541c9c35-98de-4ee5-a3e0-bafcca6365de", "value": "T19BF77C8172A14563FF6227B182D4B736EFB6BD2147B948C7394C3BB21F3AB548923611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318022, "uuid": "66fde197-f09e-48c0-940a-cbbb500fbf50", "value": "d3f487c6c23e9d9845b2eca3fbdd93dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318022, "uuid": "7dee108a-cda4-4924-a22e-da1b72038cb8", "value": "786432:Bnc8acycHZcRErYd7EzITg6fzXzSLB+iWAHNo:xcncycHiRErYd7tBRiWANo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785318022, "uuid": "8c27e9db-b81c-4e3e-9602-5decb776a3e4", "value": 71980386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785318022, "uuid": "568d50a5-f693-4bd2-9a88-3cb96e3f87bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318022, "uuid": "c8d5a9a6-1b36-4a54-af06-d0f5e8af0b8b", "value": "DeepSeek_v4_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccbfe72-8af1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785290467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290467, "uuid": "42a544b1-4384-4760-ac34-4d2f4ebe5298", "comment": "Malware payload (Mirai)", "value": "616d444d5d09d06f7a2c79d9e04d517d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290467, "uuid": "0af00d62-084a-45b6-bea6-5e3f0fa7e35b", "comment": "Malware payload (Mirai)", "value": "336ff5d2c361e594327c54a8a5398bc0255f152d175f99bf3a9efd621c51a3b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290467, "uuid": "5fd1a964-f6d0-495b-ba49-72bbc1982f6f", "comment": "Malware payload (Mirai)", "value": "8eccb26b2367a367160ab29637830cb2ecc00b0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290467, "uuid": "012653e9-c802-4470-b37f-f961c38598cd", "comment": "Malware payload (Mirai)", "value": "971507d4ba388fafd8344ca5b187cfda590b0e16f773d72917abee91f4330b568e2ff4a9847c29ba1748120155ca2071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290467, "uuid": "e3a3c344-2bba-4a35-8435-80d1e9bf7f11", "value": "T184042A56F8818B15C5C612BAFA2D524A37171778E3DF7203AD106F647B8B87B0F3A906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290467, "uuid": "0a33e5a3-02ec-4566-a16a-3c45d19b069d", "value": "3072:W+HeB+EYnNXOQ9EoKcXj5aMXRpVpbLbInh5KWZO:rHeB+EYN+Q9EkXNaMhpVmh5KW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785290467, "uuid": "c435cbab-e422-4496-a46d-53d39dad0b36", "value": 184348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785290467, "uuid": "c10283bd-0caf-497d-90c0-15b8edeefc6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290467, "uuid": "a6f1e24b-51ca-45f0-903b-367dca7f0337", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9131d99f-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333075, "uuid": "6c8b9136-60d5-4b39-96e6-2f1e9d9ad6ba", "comment": "Malware payload", "value": "89cd5a80cefd86f64b9a78c5c71db1ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333075, "uuid": "c786b07c-d3ad-4930-b9d3-12594a607e96", "comment": "Malware payload", "value": "344009fa95d9e38fa95a7f915bacdb9e744ac7cb23d63a9d2cd3f97173273673", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333075, "uuid": "80e62209-f72b-4a47-993b-bc2542cffdcb", "comment": "Malware payload", "value": "741a1504bbf657db1fa64c54059d4b861fc8139d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333075, "uuid": "fea22a79-46d9-43f8-914f-44aa71be8d28", "comment": "Malware payload", "value": "44d932fe2346364b50bd89d4d3d3ff81ddc55ef00b9f8d53b7d87d6fd6437f42228969b3769696e806fc5e3638ed340b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333075, "uuid": "80112fe8-0d92-4342-bea3-bab2ee6b2b05", "value": "T101E35B0679C1A8FDCCD9D1B44BEAF2269A72F0191538B51B27C46E675E4DF202F2FA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333075, "uuid": "419e3fe4-0b4f-496c-a9d7-488861cdf7cb", "value": "3072:WqLDbCGzATY66SCb1YERBC+Koq8ONn7CMwPgdJg8kmJx3nmm0:fdiCRfmf8SCT8tJlr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333075, "uuid": "1e0782bf-3f8c-4451-b3a9-1b0e3e98615f", "value": 154568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333075, "uuid": "2744213f-dfc8-4524-a0d1-863721f1be7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333075, "uuid": "3c7df59b-4fc3-44ac-a12e-37d3d0a0197f", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdc0007-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307189, "uuid": "5adaaddf-be08-44cf-bbe9-2cfb61b501b0", "comment": "Malware payload", "value": "8a59ec1233d2c27d96c9207e9d9bb872", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307189, "uuid": "c3b99c16-fbe4-4440-b61e-4428e1d00661", "comment": "Malware payload", "value": "3519edb22a6fe2053db5e186f338392e92be0c46ccbd388ea42975a342f82872", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307189, "uuid": "679f173b-4370-4b44-a996-c95ff1122830", "comment": "Malware payload", "value": "f770c3475740528eae81ee9f09b5492880e5362a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307189, "uuid": "24261ed9-bc54-4e2e-bc9e-aabc162eef1d", "comment": "Malware payload", "value": "e484a5b32c4bd88871c6d7288ac55ee501f20a75f0206ff0b7719f124529f2dc194bb28d6a0889b8670f9ab332a4caa6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307189, "uuid": "faba2f9d-a96f-4b75-a4b8-83b6be8f6af6", "value": "T1FF72C0ECE12B6637C57469F280E288AD78E042D36087C46E9B2DD393115B87126BE675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307189, "uuid": "dfa671c4-d91f-4753-9b00-b2dd48a35a08", "value": "384:OepfEnPbOUJNH7qSWUVF+PNZBchrOcKD93r558W4wkjUmaoa5eG81m:OepcP1H7XVF+PxDcKl529wkAmHa5r81m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307189, "uuid": "160e3ed4-3650-45ef-a640-7a855fc18cfc", "value": 16048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307189, "uuid": "034020df-00ba-429a-8314-b5632cbbd754", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307189, "uuid": "e4941fd0-74d6-4822-b9de-78551dbca76c", "value": "images_20260729_040703.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964a971f-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305166, "uuid": "9ea150cb-d9ec-4c94-a34c-5ac51d49e986", "comment": "Malware payload", "value": "e6991cb5c4912c009a6d969f61d56e05", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305166, "uuid": "ebcbab91-25fc-4b73-8ad5-d307db7de001", "comment": "Malware payload", "value": "353481fd5fd4c3aaa1f8c356b0e79f9c02d727a7a46b110c1f937ba933d83699", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305166, "uuid": "8d0b61fa-232c-49a7-9baf-a32bfa112d4b", "comment": "Malware payload", "value": "74184fd18a92878169aa890d59fce8c1dfac065e", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305166, "uuid": "04f85bab-e238-4f18-bbe2-c3b977505e99", "comment": "Malware payload", "value": "77075593cd69e420fbcfab518c26b1f1aa39ec1eaa445157954b1e47691b2fae8ec9806024c369f10771085763156ed5", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305166, "uuid": "b10afa20-3eb4-409d-b3cf-2fe52723fba6", "value": "T187B58D13B704AD31C18EC335ACF96759A33163AA3F079B6A7958D498BCC73C08B94799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305166, "uuid": "3aa6fe2b-4845-4c25-bf1e-007b3f5850d6", "value": "24576:tMDKUocMf/JmjW5jOzig1XW/gGcdKmrv94lMSTwybrBkb+v0:teSYS6zig1XW/gGcAw94lMObrB9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305166, "uuid": "dbabcc63-921e-42a2-a592-51f2506a4219", "value": 2462296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305166, "uuid": "333cdc4d-069d-4670-a7bb-a2e1de6c187c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305166, "uuid": "63854ecb-903c-4000-b5eb-15de8683f3f2", "value": "classes (5).dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd26a5a7-8b79-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785349040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349040, "uuid": "35248800-a3b9-4f23-9f0a-71fd2cce2350", "comment": "Malware payload", "value": "7be799cd97f424c820b4efd5b6bd4a2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349040, "uuid": "7b9da545-50f3-4b7a-8c07-06f4db175c42", "comment": "Malware payload", "value": "3652b0a2453858df736e1ff16e04120b296641b22f98643a7eca6f4f981c0c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349040, "uuid": "6df4baba-525b-4798-b689-f6afebf5eaae", "comment": "Malware payload", "value": "250383900a72c566db302b84c3eea556dee150b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349040, "uuid": "d3919582-4587-4607-9fd0-e04ce209966d", "comment": "Malware payload", "value": "9ce7a5047ac96ddb1311b2bd1919c208372dc59a4452ba29d6845b53444a8f914509a2425dcf3a302c8d9d2e5d2dd327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "honeypot-xore", "colour": "#2B0331", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349040, "uuid": "721d4cba-41f5-40e5-bf82-f8f5fee87b20", "value": "T17C654B8027FC0439F6B74B79BD7B18224A35BC39A912E69D0689552D18F2F16CDE2337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349040, "uuid": "61b2ca75-cd3f-4501-b31b-920f5dc5e426", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349040, "uuid": "170dabd5-1760-420c-86e3-0368ff2cbb8d", "value": "24576:ApNOI+2DR7BWYpGko440sW4z3ABW6pITF:ATOy7VXjsWAIBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349040, "uuid": "9179a8c0-4d2c-4a69-8a10-c18eb783ecee", "value": 1438752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349040, "uuid": "6700c43d-53a6-433c-8065-1b24068cd3e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349040, "uuid": "525ce916-7c2b-4946-bb84-4f5bbc5e959a", "value": "ChatGPT Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b9fd04-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307309, "uuid": "f2c424c9-4d25-4843-8d07-f94b46cb97fa", "comment": "Malware payload", "value": "8e20a72e3d8ec57e4f223b0fe96bebca", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307309, "uuid": "7783afe4-308a-4f80-a08a-936495f12ed6", "comment": "Malware payload", "value": "3691a01eda529f77eac71a04cddc8d33ad651c14c7390deda49f0d965ffb02f0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307309, "uuid": "ae47f694-f1f7-4615-a7a2-f195cfa7a2a2", "comment": "Malware payload", "value": "46756a54fe38d21dd331b9fd0c62ded5547ad9b3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307309, "uuid": "e72e2001-a283-4f52-bb8c-e011e4c8f6c9", "comment": "Malware payload", "value": "711a9d8a1654f5b6777feec0ec70d41e694470aaa0e5a87b8105f427a0ae03cc40ca021c00131e899fb4ff8e5f61bade", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307309, "uuid": "0adcd310-a5e6-4699-bd11-d6e9deefaa4f", "value": "T19842C05F0D6B8653F102107F8B93ABF7300955E4B0E39E53B5466B7B22462F216792B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307309, "uuid": "f2a08e44-79db-482a-998f-9bf6d636355f", "value": "192:NxQVmLk5eTJCY9pHksuXkT3QYqPBh7n4JepD9+ZjPzqcQ2Yao6XRuyPfYU0sECwk:Nbg8TJCsFmPjn4YMztB3ssHNL8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307309, "uuid": "10e159bb-8b50-4320-bb74-04d8b1d2365d", "value": 12269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307309, "uuid": "d1060c67-619d-471a-869e-c7e7c0d9f433", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307309, "uuid": "0205dbaa-65fe-4fb8-9bc2-9fa52f25e526", "value": "images_20260729_062305.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49b7e4f-8b8c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785357159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357159, "uuid": "d932cdcd-f6cf-4d8d-a7f5-a570afed7a87", "comment": "Malware payload (Mirai)", "value": "4b6cc90a605e5a2e65a67330b0d58ed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357159, "uuid": "3fa935bc-1b56-4f4c-9f82-27f361877e83", "comment": "Malware payload (Mirai)", "value": "36b19a238e94508cb66ee491f6c0f7c36ec07a938fd8cdf1ca292a864fba7f14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357159, "uuid": "e6d26002-678b-4d03-9d70-fa485c23b637", "comment": "Malware payload (Mirai)", "value": "fa7c16641564df20ac2daed90fcacfa4f539747f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357159, "uuid": "486e9330-552c-4176-89de-131503cd7f9c", "comment": "Malware payload (Mirai)", "value": "22c0c480c61e7ad995c303c7e1bdeca3e721c94609e9b884ffe0ba32d9da030cd450862120b040a37cce86e713b93ec5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357159, "uuid": "bc6d7454-ebfc-417c-8a07-5d83ea441965", "value": "T123632A66B8419B16C2C16777FF1EC389332663E8E3DA7203DE152F5A338B41A0E3A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357159, "uuid": "e725557f-ea7a-4bfb-bd5a-e8056a33e324", "value": "1536:i2UbdQCTvTGZc6QY4dKkhrUBvbJ/QU8Y8sZcM6lFHEoXnNNYG:i2UbeCTyUSkhUBzJ4UM+j0FHEAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785357159, "uuid": "f7f82d04-3d5b-4e89-ab74-77734a5638ef", "value": 71608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785357159, "uuid": "efc71e41-41e0-4284-bbf1-ca82cb7abdb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357159, "uuid": "7d8d6594-3fd5-42f1-bb26-b0851510aa3b", "value": "hix", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0841254-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305183, "uuid": "e00410a9-7cb8-410e-885b-495f6a586e0a", "comment": "Malware payload (Copybara)", "value": "f080a7e25bacfb2435cc9f5bdc4c12c3", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305183, "uuid": "e52f46fe-1750-4c1e-8cc8-0311194a88a4", "comment": "Malware payload (Copybara)", "value": "36ef3a11514f39f0143155711a4ca40ec546031a675a94c3b65dbae2c6d86e52", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305183, "uuid": "a7394ff0-d5ce-427b-ab56-20a94d9324cc", "comment": "Malware payload (Copybara)", "value": "9520bc32a31773126ec776985e8ca9896a3a0478", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305183, "uuid": "d5cd2c45-fb6e-43c4-8b55-3ea01088375b", "comment": "Malware payload (Copybara)", "value": "dea179088abcbe80121beba4293ac112f9f4033ff51ac6a59dd6086bec0f758c36bef8e5b3f3e4231bfa23c28d59cafa", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305183, "uuid": "90bef8c7-6c1a-4d6c-be64-0eae4a13ed42", "value": "T1BFA63313F24A8E9BF1765B399D6462C5113E3C14CF5387976966733C18BA6E08F23B82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305183, "uuid": "b3868a8d-366c-42da-9378-6b5bbb96591a", "value": "196608:1u+Nlh8Eu1wWwPLCLH+QN4ut1eMSsiYmIJLmjOItCrsbyQmKoThwp9so0GHbp:eD1xwPmLH+luHeFWmIJSamCwy17Yp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305183, "uuid": "a379b7e8-b2f1-496b-9797-9f896f7ece98", "value": 9673534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305183, "uuid": "9d006968-de7a-4218-9e6f-1b9121a9683c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305183, "uuid": "e6d94992-3948-4c06-88a8-35f8eb053d19", "value": "36ef3a11514f39f0143155711a4ca40ec546031a675a94c3b65dbae2c6d86e52.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054158e1-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320814, "uuid": "c06f34c2-88d6-4ae1-bbc6-e07d63864f09", "comment": "Malware payload (Stealc)", "value": "88fa7d9c846fd17986f8d0143cb3ca3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320814, "uuid": "abd06b8a-b24b-474a-95d8-538cbfa494c7", "comment": "Malware payload (Stealc)", "value": "375f8a4ff4eafe485b210a9ffb6a84bdbdb9c52ae602293ddae53717935e8daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320814, "uuid": "84aa3144-62ff-4a53-93aa-2ac584fdb524", "comment": "Malware payload (Stealc)", "value": "cab8109654bfee89744d7ef0e855b55c316e8cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320814, "uuid": "48bdbe2f-d35a-478d-b710-15753a5eb077", "comment": "Malware payload (Stealc)", "value": "f05816b6bc2ecdceb8f00024c0333d0af41d2b93b76a3c9f9ca806494f46d3cd5ca53b428c3d872f088f8e00a9d6af18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320814, "uuid": "4e964fbb-e055-41c9-a33c-9a6473183320", "value": "T1F5F48E1AA76542E8D0BBC2B5CA464452FB7378525330A65F079946AA0F37BA07F3EF01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320814, "uuid": "c3bd54d8-7494-4c05-887a-6d31ef3fe3bd", "value": "12288:EyxlWjpe4gaqxnbkXOOmMFQIqc0xjyo0ZbcT:jOjgaqxb2OOb6Iqc0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320814, "uuid": "4e475a2d-faf9-4948-94ff-3c434c1b4c89", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320814, "uuid": "e8613c35-1732-4037-b97c-11e2983eb190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320814, "uuid": "161eb11d-9390-4b46-96ec-085f65ebe601", "value": "375f8a4ff4eafe485b210a9ffb6a84bdbdb9c52ae602293ddae53717935e8daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c630788-8b1f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785310116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310116, "uuid": "edd01e8e-f2c2-4f48-b0bd-6a1667f8d82c", "comment": "Malware payload", "value": "f5cb2ff0db067434db4f3f1118e2eb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310116, "uuid": "d47bbc28-a3d0-4aeb-b54e-3f730f2316f2", "comment": "Malware payload", "value": "376f66963489712e9cf479b7bd7540f24bc3019a712ac1b341466515e81a9b88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310116, "uuid": "10831fe8-5daa-4bd9-975d-49a846df6776", "comment": "Malware payload", "value": "7eeefd40dd7db0bd60f23bf1ef06bd9e51d2d752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310116, "uuid": "134ef1ea-c6cd-4aac-9d26-0d199aec3b8d", "comment": "Malware payload", "value": "37f5d03cb3a0f9cc8cfbbf0fe60d6ab5c3858c50b1e9b26e3cbf46cf766d403cfd5aae2f75fd38b30c3397d39b6716e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310116, "uuid": "ed49d20b-189e-47d6-b20c-5f0bf69f6188", "value": "T11E174BA3E8931AC4C4EEC674D672416ABA667C091B3523E306A0F7241F367D4EEB7741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310116, "uuid": "19b3b3ce-202d-4dfa-a5b4-6a4a3478f8db", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310116, "uuid": "90263f76-0778-41ea-861b-b4175e5ddc15", "value": "98304:gk7X9a3MozCTNCcYRIgsZnCmiVYfFHWgdOhq8we9ueByb3FiDLZP21Uc1JHGmGyT:gcAcy94xFSLZP2V1Q8Aop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310116, "uuid": "b49fb9ed-6754-4e1b-b128-52b1bb973e3d", "value": 19612160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310116, "uuid": "1f95116e-91a6-43be-b29d-130d78cc139d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310116, "uuid": "acbc81f0-5411-474a-a664-217c8575baa9", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ece82f-8ae8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785286620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286620, "uuid": "5ac9ba9a-f3e3-44cd-af1e-26cda846a5de", "comment": "Malware payload", "value": "75a490fa24ac602f41a42cb1315da15f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286620, "uuid": "dfc02c63-d251-4f8c-875a-87114ba474b4", "comment": "Malware payload", "value": "3788186a5d8e95fdcd9f6386bf85939b865cdd50c2ea28708e673af164aa61ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286620, "uuid": "80e0793d-2f89-4bf5-8c03-fc699ee42e45", "comment": "Malware payload", "value": "740fd6cb284df2a27e3fe4d3c7730326b52c0aee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286620, "uuid": "5b327ba3-0f03-417c-9510-606045d31526", "comment": "Malware payload", "value": "88f600873a0a878d93bf3a93d4d7767e02c22603d50357f6e89c5caf8c176aafaf37d407facbbfb0e410d18db924c145", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286620, "uuid": "a38e4728-693c-47c9-af11-12b73de6d101", "value": "T1AAC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286620, "uuid": "33c39a79-f9eb-4415-970e-eeee9c52584d", "value": "768:lx8vCB+25j6es8RG9FYpMSUpi+20qUpi+20YQX:lx8l25Jwd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286620, "uuid": "50535ed5-e160-4ad9-8972-fda2e2b1aa23", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286620, "uuid": "094ef7c2-4f0e-48ad-ac58-e8f1baf73858", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286620, "uuid": "2a4fee9f-4b93-4734-b745-a046e1e42ccd", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c7dd0e-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307256, "uuid": "7a9676e0-5025-4e04-a599-8b171921f94d", "comment": "Malware payload", "value": "cd319bbd64bb4fc86430db7cfa32aaef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307256, "uuid": "c7536741-1de1-4899-b0eb-e2d4862b4099", "comment": "Malware payload", "value": "38ce4bb882a9cfbfac947bf01f3cea063dc04286a17c4efea9a0cb3569d86dde", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307256, "uuid": "05bdc311-5ddd-4aa0-be14-883e2a0ef642", "comment": "Malware payload", "value": "0c174586ba135fc60094b3211f99dd02e27974f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307256, "uuid": "c888526f-c65a-4d99-8606-7f46dbd1bcb6", "comment": "Malware payload", "value": "41b48d4176b80cf3945894778acbeb9fd6697bda936ea46eb25e5d9b69ff2416de377884e067532bcc64a7c772dedcd8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307256, "uuid": "b51f1bd7-a8cd-4ae6-a9ff-b6b832f169eb", "value": "T1D762C1A6E2652737D211E051D00B4C0B1EBD849FD9F21A13F3EA8CEF995515E2918EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307256, "uuid": "18ba7354-310f-4d7b-be3a-1d6483c4bad7", "value": "384:iiHJp4xf6z1BpebLUXRwNPto8gyesW2xllHuEO8ugySHcdkob:iiHJ2+TiLcRIPto8pesncETHcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307256, "uuid": "7e573c28-86ab-476c-9685-1e44e595d047", "value": 15214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307256, "uuid": "1a53f440-a96e-41ab-a9c0-53c098564e60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307256, "uuid": "8ce9a51b-ad26-4c4f-b949-860792098ead", "value": "images_20260729_030742.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6d5afc-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785311535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311535, "uuid": "5a52a418-1ee0-46a3-82e4-1f3da09612fa", "comment": "Malware payload (Mirai)", "value": "d3aca4585de7ebbf93e5e282926f486e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311535, "uuid": "769d438f-24fe-4e42-a225-13b410ee9358", "comment": "Malware payload (Mirai)", "value": "395c9fe4498c5bfc2718a994ee82d3059702bcb965a8acd0770946b112c0060b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311535, "uuid": "8ec18620-a92e-4c71-b3e2-ca153b8b18bc", "comment": "Malware payload (Mirai)", "value": "81e6d1f1112c5069fe981dd913df109458dd5e01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311535, "uuid": "2cfa03bc-f9eb-4bf9-9fc0-0beb4471523b", "comment": "Malware payload (Mirai)", "value": "80d45c5a5fb52174edd914caa001d38ee92f666a430b974d6a8758918b419319db6d2c4ff168b634a11629c66e8883cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311535, "uuid": "08a09218-f1a5-47a5-8869-ec98d8d3ed6d", "value": "T10A333B42731C0A43D3A36EB43A3F27E193EFA99120D4FA89351E9745D271E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311535, "uuid": "9a2ed20c-c75c-4c54-aa86-19625d5ac728", "value": "768:GKaVpR66/ueUPDlJLE3qPGKjApmNGFztyeWS7RF6y9d9iy+ZF1StcoAI3A:VabvgRJ81yeWS73fdMRRS+oAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311535, "uuid": "661e34b1-3d91-40ac-9bba-32bd047caeb7", "value": 54680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311535, "uuid": "27d7237c-3ae1-43aa-92f0-94a6b7116da5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311535, "uuid": "d421ee5a-5ff0-4bdc-a2f2-aafa60259f46", "value": "real_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4121f3a-8b37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320732, "uuid": "a629ba34-9bde-4394-82cc-7ee88e483696", "comment": "Malware payload (Stealc)", "value": "82e7e04741498e2762a85beb65063d7f", "object_relation": "md5", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320732, "uuid": "4c468fcb-44f1-4299-964e-c72e166c5f7c", "comment": "Malware payload (Stealc)", "value": "398f5afa66a223371927ab84bd7c142d510de07887ff24e038edda78e2be5be6", "object_relation": "sha256", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320732, "uuid": "0dbd63fd-9553-4953-bb59-47d52cd705a3", "comment": "Malware payload (Stealc)", "value": "235fcbe94b400c27d60a9da89862fce2e4e80ec0", "object_relation": "sha1", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320732, "uuid": "603563af-addf-4487-a35a-ec28809e6e75", "comment": "Malware payload (Stealc)", "value": "68d055184ede36f855a54009ebad90e72b4745593767df074cc51e58a2215a5ca27b7ea7551cf13ad08612f2ae64a984", "object_relation": "sha3-384", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320732, "uuid": "b7226990-56ee-47fd-9e35-4efef95126f4", "value": "T1F2C2D516C918AFF00B6F6052DD0B2D5985610735AA343D0DB5CE9AAC2F39326CFC91EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320732, "uuid": "6c95f545-e54c-4337-876d-45c0d4f10432", "value": "384:Kw4pGhqcExihLhDIhcVhUhfnnU62ywqatv6mpjZp9O5iFWq09eQimYCAl9aZ:KBs049ic/6fU61wPp6SjfvFdmjYeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320732, "uuid": "409c0f2e-ebd3-4f90-956d-d86ee51b1ab4", "value": 26215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320732, "uuid": "53ec5f2a-6fe5-4ebb-90f2-d4c8c72a235d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320732, "uuid": "e4546e32-42fb-4880-a181-8fbfa5dae1a7", "value": "906581.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22632000-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320863, "uuid": "c5ba93c2-3076-4df1-844e-bceb2f886239", "comment": "Malware payload (Stealc)", "value": "d1b8f36f0654d83e8f85fc828ccd8beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320863, "uuid": "9d443b0a-7859-4fb2-b3b6-fa12d11bab2c", "comment": "Malware payload (Stealc)", "value": "39e07fb60fbf206b06d1b5b2b74848d9d393c6bd66fd11e003436cd7ee6b5788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320863, "uuid": "3850d558-99aa-4c27-b6d3-5c08694d5b59", "comment": "Malware payload (Stealc)", "value": "06452584003c6bfc2962d97ce28c24ddeeaeadf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320863, "uuid": "1dd3e7f5-c1ae-4554-89a2-cadf8bbbc441", "comment": "Malware payload (Stealc)", "value": "ed37032fd1211194831e5f21f95543f6930a3be70098c318d0d6d0e3b748bf5437563564f2ea3c678f122041e1586c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320863, "uuid": "350d17d9-7c04-4210-b93c-10edc3787d08", "value": "T164F49D1AF7A502FCD07BC275CA4A4952EB7278565330A78F03E15AA51F33AB05B3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320863, "uuid": "d2e36b52-6936-4c6e-ad8d-270e6c59a642", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320863, "uuid": "b39dc7ce-2aad-4b03-86cb-59f597c45e1a", "value": "12288:s6HSXamiqz8TbhvbTOMfJr6EmbAMXsDyxBlDetAqxSvOc:MakzIbhvbCCJ+pHsDybm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320863, "uuid": "95ad4d16-bac9-4d71-9283-92f041781fbf", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320863, "uuid": "a3fd50b2-9d43-414e-8207-4d4ef5d50fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320863, "uuid": "28c73283-17b4-4955-87ef-d209552520f6", "value": "39e07fb60fbf206b06d1b5b2b74848d9d393c6bd66fd11e003436cd7ee6b5788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf35e4c-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307375, "uuid": "712b47b3-4cf0-4941-b390-0d1cc9bab06b", "comment": "Malware payload", "value": "cf700e56b2495003f3dfca96b540d5f2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307375, "uuid": "1ec2c9a0-4a29-4d1f-acfd-383c4300d840", "comment": "Malware payload", "value": "3a066ff264cf26ddb814cfd79ce068febbf8b513c28fb99b45774b67aa82e202", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307375, "uuid": "147a87f9-6a96-4bac-bb87-809a3a34fcd6", "comment": "Malware payload", "value": "f5af3fe4ac3279017a59b109fd1d030e6c709ace", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307375, "uuid": "7d0babbb-a7c3-49dd-81c3-acdcfc0597e8", "comment": "Malware payload", "value": "a4383fed2b590091554c5462d6fcfe3fc19f17d8002c93ad082ae7136a8321f911a400eb8204e20f38c73d552a6ad26a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307375, "uuid": "2a2cf399-94fc-4067-a07b-1a11733ec031", "value": "T1ACF1AF13D9D50607DE28D3B81A718FBCBBAF9E1E54353899DC4B242581CE686C50A4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307375, "uuid": "3256ca2b-a3bc-4113-a6ee-7ce6da30b609", "value": "192:WAoHuxdTGPXUMHVxeozmq3pMNSHZnwK7nPWOhZPlC4:WAKPEMxzmeWyRHDWwE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307375, "uuid": "28ab70d2-bce1-46e1-b6fd-4bf2c8fa39cb", "value": 7683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307375, "uuid": "d0f28810-e99d-4f05-a2e9-703ec99c51e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307375, "uuid": "0764caf9-c704-4e96-bc1a-0406623bdd8e", "value": "images_20260729_020846.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6577b3af-8b3e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785323553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323553, "uuid": "6304d329-ecfe-4672-84a4-e293dfbcac05", "comment": "Malware payload", "value": "3351888ae9c8a26ed6f8196217120fb5", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "icudon-com", "colour": "#AA7890", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323553, "uuid": "6e85c77e-aec4-4e05-849b-e48a396cb3f9", "comment": "Malware payload", "value": "3aefeb77d9d51f85a2637c01e6bcfc74e9469a7bdf36fb908a5504e9cbdda7d8", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "icudon-com", "colour": "#AA7890", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323553, "uuid": "3a75e9b8-791c-4b3f-b92e-535dfe410eca", "comment": "Malware payload", "value": "41293510c3fb55e11008d53073574e79fcb6d4a5", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "icudon-com", "colour": "#AA7890", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323553, "uuid": "b9573be8-52e8-40ee-a9cb-19928e5f94dd", "comment": "Malware payload", "value": "64bb1f824678297bd0041c433d990a6be4a0b89dba52a85c9db6deb16b5fe7c31f2b041eb28ee38388cc4319c7682f25", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "icudon-com", "colour": "#AA7890", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323553, "uuid": "0592a26b-a333-4edb-af16-6c6dc52eb12b", "value": "T18321D85CE1239560CE93D8B8A19C132D610A9A78168DE6A5A677688163EB014D7ED134", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323553, "uuid": "16872248-9b07-4a40-8d4c-2dedd1f9b09e", "value": "24:97zNNL5Xi73V+R3IYoXKD2h7OOOJrCThsNSxDGmkQyohMhrwUEAtz0fCjKWMd3zH:97Lxi7kVzo6D2h6OwQ0TQcDTB0frtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323553, "uuid": "7876e566-6e7b-40ef-8b21-f55a5b5ad260", "value": 1438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323553, "uuid": "a966b0ce-fa49-4671-a316-4488f0d349f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323553, "uuid": "b28ef516-4222-47b8-b7f5-dd6b9911606e", "value": "photov_922261487861.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b67a8b-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785332916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332916, "uuid": "855ed57f-7701-4359-85ec-ab25e1ea21c3", "comment": "Malware payload", "value": "fd252d596395ab4ad8dc4986e6534bf4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332916, "uuid": "076d1d64-0356-40a0-a26f-50526e15a508", "comment": "Malware payload", "value": "3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332916, "uuid": "4bf57251-319a-418c-bcd3-68907b8d9da8", "comment": "Malware payload", "value": "504d5c96602e476bec70ee3b978f5f1c4469ebc5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332916, "uuid": "13b60069-f8ae-448d-938d-abf408f7ea4c", "comment": "Malware payload", "value": "71a60d2a10c5fb3742f04f15650548335fa253be293be00439e383b0884fe7dab03a4da65df1973ba6350d1a4e632303", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332916, "uuid": "a605025f-fe77-40c6-b0ac-fb2922d0ad8b", "value": "T1AC730896EF08D9F43C50C22D1B518E0DFA0E92D702157864B0DFB8A42B9CB73B97E616", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332916, "uuid": "d799080b-6369-4e7d-a5ff-073930789eea", "value": "1536:30KhgdpevVnosI9fsQyeSxXeil3hLh8xLdfhQH7hrt0sHzmBWptxM7vWB06putR4:kXdmVnosI9fsQyeSxXeil3hLh8xLdfh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785332916, "uuid": "d910dbf2-155d-442e-a659-d068abd38dad", "value": 80645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785332916, "uuid": "9a091895-ebf0-4354-8451-706717479c79", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332916, "uuid": "778239e5-495e-406d-aad6-41f282deb946", "value": "install_panel.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68727055-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785311532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311532, "uuid": "0e201a3c-32e2-41c4-bcf3-f4ce02ccb41e", "comment": "Malware payload (Mirai)", "value": "fd1d52be34f8bfe671eee4dd0ee92775", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311532, "uuid": "ce9f8da4-8861-4b2a-8f4c-06426312a7a1", "comment": "Malware payload (Mirai)", "value": "3bfce4dc88b073a8ae6c85129578b376aebd83ca2b5adbb609cb8935f5b83dd0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311532, "uuid": "749a983a-2017-49d8-ba36-492086200ebf", "comment": "Malware payload (Mirai)", "value": "a3f896b34abdd9d12daafd119259d6281264d226", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311532, "uuid": "04a25c50-d2cd-48e0-8bd2-baeefaae2674", "comment": "Malware payload (Mirai)", "value": "97162246e55ad408db98720d4183853ef2affe6eb70623ad6c2a8f43d5067343e79640abe62fb2b2d0192d1ce1644369", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311532, "uuid": "b4cadc8e-bba1-478e-b20d-f9cabe84f51e", "value": "T14E238C73C92A2E44C14986B170309EB52763E5028357AFFF1959CA399043EBCF9663F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311532, "uuid": "e5c99575-b4c4-4225-a933-b8aa69813afc", "value": "768:dVXmXXROjzeylcLC9YLq+VrC43so/yuyCrg3Kw77VHa+eMMtSfLSsI:dV2azFlIBr57RyCmKw77V6+eAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311532, "uuid": "1c457c2b-4603-415f-962b-a8db8cf72f43", "value": 47200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311532, "uuid": "e89f79af-8010-40fa-a373-c5c652433843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311532, "uuid": "1fdb6b36-0b58-4659-bdd2-685455cfc422", "value": "real_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a6fd9a-8b42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785325355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325355, "uuid": "0dd1850f-9b68-4171-b5f2-112c5571efca", "comment": "Malware payload", "value": "0860e04de94b8c3d08b192c64edb9167", "object_relation": "md5", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325355, "uuid": "ab46c762-581c-4945-9056-062dd0c7e898", "comment": "Malware payload", "value": "3c2227bf19e1c955aa405ea712263567aa4b8398a04d299c0f1ac72a68d8b078", "object_relation": "sha256", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325355, "uuid": "2ae1d984-7556-47db-8d8e-d0b57172ab23", "comment": "Malware payload", "value": "01ad8ae2f09ac2cdd2b2a6700848220978ef4d90", "object_relation": "sha1", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325355, "uuid": "9fa3fd0f-16c6-4dec-bf4d-28000bd9b671", "comment": "Malware payload", "value": "467ec07ddb58769309d8b842f8f149d64e4268d1024de46f195e75d4d09668f9a77f3d99ce26c3bd64c610f56aa2f99d", "object_relation": "sha3-384", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325355, "uuid": "8aaa7cd9-e58b-455c-a188-ce811b45db4c", "value": "T13D6733B76AA7CD9DC86BD07122F6961F6E556F3F34C0E7246900A99B1FC3A1F180091E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325355, "uuid": "8ca89e14-e758-43d7-8d05-5f9111cfed97", "value": "786432:pY0szcyRKRd+3fgniTi+PQZP4dTGaBv5r2m4:lswNir2+PQZP473r23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785325355, "uuid": "ef85a14c-e8fa-4eb3-8688-14c6ba485b38", "value": 30169301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785325355, "uuid": "47007d19-2344-4ede-8c14-1e3a66009dca", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325355, "uuid": "5a79f585-91a4-4016-8831-42944b69352d", "value": "3c2227bf19e1c955aa405ea712263567aa4b8398a04d299c0f1ac72a68d8b078.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaac807-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307430, "uuid": "aa5bbfd0-97da-42fc-b479-a69a5a087fd3", "comment": "Malware payload", "value": "7f7a252483a8844fa43b2eeef2a13d79", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307430, "uuid": "f7a6dfb7-1fbd-45a9-9ae6-bad54abdb5ab", "comment": "Malware payload", "value": "3c249a9959969177ed3cef5952f04fb169439768f7993832723be6d13f96cd65", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307430, "uuid": "f8dfcd09-76f3-437a-adb6-136f066166f2", "comment": "Malware payload", "value": "e620530a0271bed1774e4b5a7a4e1d50428ba405", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307430, "uuid": "58b4c640-467e-488d-9c93-f20b2bca84a3", "comment": "Malware payload", "value": "c097045c83d559efd65b95c28ad91e2e42fcaae493f73844fbcbc02980cdf321299ffc07c00a17e65f5af9daad1569de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307430, "uuid": "6a521738-8092-4a11-bdcc-c62eded510eb", "value": "T1AA919EF2B568E901E0C8D33B385FAF98115B239B79068405E5710C2A79F84BA26BF907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307430, "uuid": "8a071b43-d3ab-46b1-bcb6-acb3097af897", "value": "96:BgSmC+De6ud1X2HFVyS/BwDWwkv84wqDwLZ/BGzOgsVzDF33/D:WJ9HFV5wDnkv8QwLZ/mOg6DF33/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307430, "uuid": "38d6e284-06a6-4f50-a198-fc0463303220", "value": 4521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307430, "uuid": "0aee84db-fcd4-4f84-99e1-982ff8502af6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307430, "uuid": "3d36c787-1f41-4d6b-ab0c-6e81456b1b24", "value": "images_20260728_094114.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3da9a24-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313859, "uuid": "1268a0a0-9e73-46f2-8322-aee2db7a3771", "comment": "Malware payload (Mirai)", "value": "3a4016ae28ac5c89b06d9d932833a889", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313859, "uuid": "654aed9e-9c09-4024-87b7-19c3e806591f", "comment": "Malware payload (Mirai)", "value": "3ce8f79aeafb2664e8dbb3b08d06ac0d853531ca3c81e40888575b622cfaab07", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313859, "uuid": "39d136a9-bee3-47c4-bef9-dc951aed9594", "comment": "Malware payload (Mirai)", "value": "e08632a3143d8b0a8bc2ee216f634ab13a025f21", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313859, "uuid": "0d962c21-d832-4a07-9a32-8f49453ad6a2", "comment": "Malware payload (Mirai)", "value": "f72bd74b8752171cefe6490e8e89b5319af7aee923b651393838411b06faba560e7b85192b71f046ad16cacd7b6408d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313859, "uuid": "410c6fad-8174-4841-ad11-ac1944214609", "value": "T1DA330891B8819912C5D412B6FF1E428D372667A8D2DE7303DD265F20378B92F0E7BA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313859, "uuid": "34da17e5-6762-4419-868f-09899a4b5f48", "value": "768:vRhpahrctLS+yacHlHk/QipW5SPoGZ/NwbyGtO9L9dfn1p4KkM0DuwSJTmr1ZwI:pahucHxuQCW5SPxGtOJjfD0mJqrfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313859, "uuid": "1fc8cf4e-d3e2-482d-b6ab-98f5a210849d", "value": 54580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313859, "uuid": "07219d34-9ea6-4a93-ba3b-ceef1d80713c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313859, "uuid": "6e5cc9eb-eab4-4abb-b326-b2f9b74a5108", "value": "real_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c75438-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307447, "uuid": "17a0dab9-e897-4e19-a7de-a16cace12e55", "comment": "Malware payload", "value": "07f74b1ca50336d6e9e47c05206a96a1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307447, "uuid": "52d0eb37-619f-4510-9344-ee511ba2fc46", "comment": "Malware payload", "value": "3d126d71cbf749f967a86a66af45d58e5a28ddafce98a8296c488ef1eccd8b4d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307447, "uuid": "5553423d-d9fe-41f2-a839-c15157873b35", "comment": "Malware payload", "value": "389beb6719ddf92ad8208267d8d49ed874295ced", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307447, "uuid": "dde02147-497d-4d5c-aa27-58380c57d1af", "comment": "Malware payload", "value": "76bb3349da0a7460ae42f0c2b78f63199861905a3d1e695409e66eedb15bfe42bccc895db351e2483849cd2b13a738bd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307447, "uuid": "633c16ab-6227-4059-bfda-3230e19e624d", "value": "T1F5617C1079FA6050F75FB3A073CBDAC9301690AB91468BA8BC8409DE3CBF2523C90900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307447, "uuid": "7acccd73-c6bb-4939-99e3-f4d866300c8f", "value": "96:sbsG5mB9noY+wInG2Th/6NxJ0Z+N3VIdNbqF5:v8HxTx6Nz0l5qD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307447, "uuid": "7ed5e917-64a0-4ece-adc3-2d229b67cfcc", "value": 3375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307447, "uuid": "92c85c35-cd39-43b8-a2a9-237ac1164935", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307447, "uuid": "f820a89e-a3e8-4b49-9276-66afb06c0cdf", "value": "images_20260728_170227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0905c616-8b2a-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785314808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314808, "uuid": "5f389282-6118-4b3c-9657-1a54e010b624", "comment": "Malware payload (AgentTesla)", "value": "1abe66e1e17395e8bc9aee5f1e4223fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314808, "uuid": "72741255-9be6-43b9-af14-a88e9b35f54e", "comment": "Malware payload (AgentTesla)", "value": "3dd18766ce04fb157b0323e5302cfc09257f0856d6eb8e6452392c6adbd17cd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314808, "uuid": "c3497dc2-8f01-4cff-8571-b454aeaa0bb9", "comment": "Malware payload (AgentTesla)", "value": "173c335224f8f4b26a8803e03445150101e1602c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314808, "uuid": "372d6b80-3550-4c58-b936-c5e1d40c9f85", "comment": "Malware payload (AgentTesla)", "value": "092f2054167953c987a64cb81925f76c412687d41c91489f2d9d0fd95d8e14d7ca478a978fd9eee495c3583a9543624a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314808, "uuid": "f918f87c-ca10-438c-8724-47d55a82567c", "value": "T190E43A3D02B620C7E4ADB6B1CD06ACE105222D34517B5A632EFEF53D297C475890EAED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314808, "uuid": "2a8ef756-d30c-4f06-8349-fdaef53394bb", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314808, "uuid": "b861fa1b-b5ba-47a6-8b93-2b285db3d19b", "value": "6144:iX45rw6XDe32PNriZQbMuNs+J+DL9CfqsVmWI1irLOMrD9OFpYoS0ttWjaIkcx0a:iX4PHNriZQCZGNrDu7bttW9Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785314808, "uuid": "c33a529a-c11a-4647-8d43-8c96c860bd90", "value": 677479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785314808, "uuid": "084dcfc9-0f55-47be-9812-c2f577c67bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314808, "uuid": "4e9251e3-e8f3-46ad-a82a-3927019ea930", "value": "Nuovo ordine n 1557.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4e7dcd-8aff-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785296395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296395, "uuid": "be6f3f5a-c089-421c-ab34-8c5ad902cc5d", "comment": "Malware payload (AgentTesla)", "value": "fc76a69330918c7327b4990c7747ea67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296395, "uuid": "9574159f-39c5-4174-8552-0d608ef953d0", "comment": "Malware payload (AgentTesla)", "value": "3f09145757282e6a59cd69319ac3b9da3265022a1d4f92a1646f8ddbaad89333", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296395, "uuid": "b103e891-cf0a-426f-9147-ab7c2c78f4d1", "comment": "Malware payload (AgentTesla)", "value": "fff4450ee888252cc54c850a2850a00999c1ae4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296395, "uuid": "621b82d0-36be-4df3-8738-2ad358fe6b28", "comment": "Malware payload (AgentTesla)", "value": "9ecf3d9ec26d121aaa5648056cf29f4a26caeef6f97139067b1ac922fcac46e500028a8d72c476d087cadec930a7b731", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296395, "uuid": "ff877f1b-d546-4ab2-be17-4e4b59fa6d55", "value": "T1B506F88143D1847E6A20D7CC79B7D9A1438EB18309F5DF0634BEF2087698C9763A9AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296395, "uuid": "e99166b4-3fac-48e5-8a8e-81d73074f599", "value": "98304:cdSbcNIQXCha/RcQXmvaaYodPSz5HKQNtjPcuBgicN:cdSbcNrChc6H8Nxnj04hcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785296395, "uuid": "ef8a4ae1-f4a8-46b1-925a-2e57093e4f41", "value": 3904391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785296395, "uuid": "1f89cd9d-800a-4e1c-8247-9388ccecd96c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296395, "uuid": "72269c54-ac5c-4e73-9cbb-de91afa53041", "value": "\u8acb\u6c42\u66f8.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecbdca5-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785354707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354707, "uuid": "40b0a988-ded6-4aef-abce-14802d2b76dc", "comment": "Malware payload (Mirai)", "value": "a751ea8a6607d2922493d25509477157", "object_relation": "md5", "Tag": [ { "name": "ByteToBreach", "colour": "#883AFF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354707, "uuid": "cec1af03-a02c-4378-8ffc-5c3d523a510f", "comment": "Malware payload (Mirai)", "value": "3f661a590790cb90966dd89803bfa662abd8aa67bbf4d90e44888a48399597f9", "object_relation": "sha256", "Tag": [ { "name": "ByteToBreach", "colour": "#883AFF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354707, "uuid": "d328a1f8-dc36-4320-9051-9192f0ef269e", "comment": "Malware payload (Mirai)", "value": "0a24f046d805011a692163372aae5524772ddc57", "object_relation": "sha1", "Tag": [ { "name": "ByteToBreach", "colour": "#883AFF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354707, "uuid": "e83ad5ee-8876-4061-926c-6071851ff7a6", "comment": "Malware payload (Mirai)", "value": "f39ad1a4feb4a1c008e4ff0edbca3e560f7cb11e773a26ad824f00cca65e6eb5cdd92b3f7bdd23add65cb8250bb56364", "object_relation": "sha3-384", "Tag": [ { "name": "ByteToBreach", "colour": "#883AFF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354707, "uuid": "d68fe07c-bd29-483d-9f24-b92b282808ef", "value": "T1A316AE5AB5BC0877D88AC8B0C38ED3825E3474A805D1606B7E5526E53F69F705EBBF02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354707, "uuid": "23e251ce-d0f3-46a3-abcc-bf44d366c510", "value": "49152:Id7Sm0loRyVMriA8OcEX+CfGziviONbA1PDijvszlQCKsCck7PbwA2ghE+YIB6TQ:ztjVtnHziaONyLyN37qghJkl9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354707, "uuid": "4e39a697-9de0-46a7-bb02-85bdbb732d94", "value": 4227382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354707, "uuid": "c90e8cde-3468-4046-beca-1ee85084c6e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354707, "uuid": "f3a147ad-2631-40ed-9d0b-b8c220e3829c", "value": "bytetocrypt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63fba8d-8ae7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785286349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286349, "uuid": "6dd996f8-fcfd-4606-b5e2-9c30601687f5", "comment": "Malware payload", "value": "44bbbb4ae98a461f7326543e0c0a4947", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286349, "uuid": "6e82d8a7-d9a2-4e73-ba75-05496825593e", "comment": "Malware payload", "value": "403cf85efeba8cc0e48dcb4fb7b22fa830426d4ac26d613d1e637ef64009581c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286349, "uuid": "60e566ef-12c0-4c9b-ae61-71aac0c5cace", "comment": "Malware payload", "value": "76f80956191acb8aa809e89b6dc49274707c1758", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286349, "uuid": "c8d99116-7ea1-4526-b325-e7622d1e360a", "comment": "Malware payload", "value": "1949a1837b2478a2bc25e1453c2bafc0b57bb54899537c5fc22829d1dbb06f4805ec37433b838b382a80cd63ff8f3d1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286349, "uuid": "4ce91615-fe6e-4f5a-b9ea-61580b731db9", "value": "T1B3235C651A857C14AA98C4361D7F2F0CB9AD43E6320492EE7FCF3CF28C5A6AD910572D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286349, "uuid": "17e28b9c-0833-4624-a683-2220934318e8", "value": "768:u6Utd8/R9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ycr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286349, "uuid": "1c483cbf-5034-45e5-9c1e-4ca38aeb13b5", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286349, "uuid": "394f2a38-d29a-4f51-97fc-b60d14a2d07f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286349, "uuid": "15f4bd94-a23f-4081-b2bd-b9d5b5ed64a7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d894c98e-8b07-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785300123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300123, "uuid": "9233dcaf-d049-4697-a52b-075567659714", "comment": "Malware payload (CoinMiner)", "value": "0ba5a3775a17b28970509867c3917904", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300123, "uuid": "f449b8a3-6827-41ff-ac68-977433a6b141", "comment": "Malware payload (CoinMiner)", "value": "40560c7370ec0e7d3f9eedf55774cd9fc09f13f1a01f822e9d8830b57ea8d9cc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300123, "uuid": "f69b5a37-31d0-434d-8828-a50ef76fb642", "comment": "Malware payload (CoinMiner)", "value": "2e07255adc0e79f466e4839c4d0bc3d491d99bec", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300123, "uuid": "8d15507b-d3e2-4be2-ac2d-c25a700b3203", "comment": "Malware payload (CoinMiner)", "value": "55fa42cf4f3496bf7e877765ec116e7e4da5eec90eaa48ed234d534fc9e765a66e48863b8509a625e0b6a96bf72cefa7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300123, "uuid": "3b0622ef-f3d1-4219-bb49-0da1539b9efb", "value": "T17632912D7D860331DA1009B8E4798247553C6EA3B743EBDFF273E69B19C6A4588C092F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300123, "uuid": "d05ee405-9f6a-4775-a906-7183bb15b197", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300123, "uuid": "a03e55e8-7c67-49dd-ba50-c14fc6bab0af", "value": "192:hToFMBQnBP4xeu5PRTPFJxTEZmFhEaJ2N:xoFXKAgRTPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785300123, "uuid": "89ce8f24-af85-4687-8131-5a044321fc4f", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785300123, "uuid": "01e562f1-8602-49f4-a55f-2e1f2cbbf646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300123, "uuid": "30c0503b-7d2c-48a1-ae99-782e8e7ee5f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823d0622-8b65-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785340351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340351, "uuid": "36e0db7a-dcf0-44ae-b431-d124a43184c0", "comment": "Malware payload (Efimer)", "value": "23c6244df18b30fa08cb97ff92e83414", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340351, "uuid": "4cd0eea8-855a-435a-94c6-35d9fc64e21b", "comment": "Malware payload (Efimer)", "value": "40717c6dd9e3d28afd7937b8651efa2096c77478633ca1039f23c624ea322045", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340351, "uuid": "e0163770-a9bb-45b7-a084-f4d13f0cca7f", "comment": "Malware payload (Efimer)", "value": "04ad4fd8dc5d6665be4fc61cd277965f2502a17f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340351, "uuid": "29495e54-70c5-4aaf-8d9a-4a1dcd95aeaa", "comment": "Malware payload (Efimer)", "value": "4b125e6101ce898295ec451d33a14c64c7f8c0b817fee2a5eea08193942f3e4f56047f7338851b1dc501a041d20402c7", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340351, "uuid": "257ab245-7fe6-40ec-9426-dcb787a4df8d", "value": "T13AE6330853E042EED1F34078DEF07665E598B8B29B65C49F47A4D279EE672D08C3EA07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340351, "uuid": "6437e4e0-073e-4974-8ea0-2e317a1dd5db", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340351, "uuid": "70f55d83-4ffa-4b09-a4cd-36daff119d16", "value": "393216:sRhVQjUagogP8ZTtKDIDXMCHWUjX4cuI3/PGTAI:sWTgd8JtKUXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785340351, "uuid": "90af0063-2f38-4d34-8195-5b888e86bd45", "value": 14301365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785340351, "uuid": "28743352-03a7-4223-a444-ec1c80f55f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340351, "uuid": "25b147ee-254c-4535-b834-71dd7eb68cca", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a5fcef-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307153, "uuid": "05c0b5f2-fba2-4c75-8947-60b0b4437b50", "comment": "Malware payload", "value": "7f9e8192e18302cb9e4dfa74c6a0162d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307153, "uuid": "456e2b82-4fe4-40d1-be5c-a1465584ad6f", "comment": "Malware payload", "value": "409d8d82e1cb03d73772291185ddd52d24cd9686284d743636472e1ddc3106c4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307153, "uuid": "c6a62377-697c-423e-8bb7-785258e2181a", "comment": "Malware payload", "value": "52423b9c327a4f5ca87c399f8401892dac9a07ab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307153, "uuid": "2b1c27b6-c21a-4062-a96b-c95dee1b5d84", "comment": "Malware payload", "value": "1adc7922a42b3fd821d50b4787cb4e7c885e7ea3b9644a3409033ddee66a0fe6429ba4ddefb7fab7704d0f4332b8c956", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307153, "uuid": "240250bc-023e-40c7-91e5-15d7f17f2c99", "value": "T12972C093986F6D7BCEF123A30F8896D2FC164E856E813A4B11610DE84F47FC091649B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307153, "uuid": "6f5ced4a-cf7f-4e00-a59b-bf0b4b2d5ddf", "value": "384:a1sAL4RTsTFRC2QBFerJEJAs7b7zukdz69nsmkDuK0DY3Pl+dZIl:afzjC2Qkobekdz6lsm5IPlcZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307153, "uuid": "1e5546cd-9878-461e-813e-99d51e5c0167", "value": 17319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307153, "uuid": "8994840b-e25d-4f35-a68f-ba1ad364beee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307153, "uuid": "0184cb6b-9233-422c-a585-aba58ee66be0", "value": "images_20260728_233640.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90becfb5-8ae4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785284971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284971, "uuid": "d4cd3c61-4105-4547-abb0-9351e782a9d1", "comment": "Malware payload (Mirai)", "value": "71592b8af339e0c56af960954953773d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284971, "uuid": "3379c999-fc77-46b6-b657-e73988d012f7", "comment": "Malware payload (Mirai)", "value": "41c0e8e47dfa4844066f4b76f2fe979694320bce1c4f7a9bb5e20a07b618b98c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284971, "uuid": "a7a3afb3-8c8c-411e-b012-3915f2e8b702", "comment": "Malware payload (Mirai)", "value": "1f68cd9d23ee65fc2138f703d279b575f5436825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284971, "uuid": "0be575fd-3d18-443c-a5b6-6777d7de1dee", "comment": "Malware payload (Mirai)", "value": "8e6ea25d25556b75de01cb42e7c26b5b39a6847603c41f0edc853a882f14ac85cb253b72f7aa8033c36a6ce1d40ca494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284971, "uuid": "648abca7-4db1-4fae-b9ab-0d2043fb2a6e", "value": "T14D144B46E6818E17C0D717B9B6AF8201333257A5D3DB73069A14AFF83F8765A0F27906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284971, "uuid": "be70a39f-9100-442d-a130-03526e4fd8e5", "value": "6144:ch/9I0YkaqbYaWl40V5SnLEZLGZn+zcIM/9RxvmvwciztsR:mlI0YfqbYaWl40V51y5x/ZvmvLiztsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785284971, "uuid": "625f71d1-7279-48f3-a362-c1b2e2022183", "value": 204974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785284971, "uuid": "ad443465-63e8-44b6-814f-6dd937b630f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284971, "uuid": "f9af3067-5f3d-43da-b858-fe8013bb396f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88029f1-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305197, "uuid": "55139c9a-06cb-4cc4-8f1f-d7380778573c", "comment": "Malware payload (Copybara)", "value": "0acc2b176b7fbcea07230b467554dad0", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305197, "uuid": "c117370d-0f42-4409-a3d2-0ab41edbdcbb", "comment": "Malware payload (Copybara)", "value": "424d16cdbae8c830a8ad03a5eb1e95aaa3f4d6aba56748fcc2c7c79da83f79c1", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305197, "uuid": "d86851cf-d134-4070-8c9e-d31fb7827eab", "comment": "Malware payload (Copybara)", "value": "b359c2fd4d54a4c7c4d4c61b9f6f5e97182b94d5", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305197, "uuid": "b84ffe64-b213-4505-910a-7f4c2e264139", "comment": "Malware payload (Copybara)", "value": "2b2a442173bf9f9a520d0b0f57d45d4de14828d735805382e0afbd8f8ef28e8a060a733b5d14220e44692579a4ddb40b", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305197, "uuid": "90e03605-8cba-408e-a80b-9f5dfa569be9", "value": "T1CBA63377B35ACA9AE47A8E369D25629400353D04CFA38A17A512737C28F9DD0CF19FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305197, "uuid": "49a07889-acd0-4db5-8fca-c20db7b7a1dd", "value": "196608:bIS1wWwPLCLH+QN4ut1eMSuzQIqdjYFYEscbN2WwOMX2acZA1wj3GL:/1xwPmLH+luHeFeqj1M8WwOMYSwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305197, "uuid": "25f4cc14-b78a-4db9-a2ba-5a5f1c2b0c97", "value": 9702115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305197, "uuid": "054387f5-019e-4206-97d1-cb524736d140", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305197, "uuid": "1fce92f0-369e-4f1e-adad-e33769b7969b", "value": "424d16cdbae8c830a8ad03a5eb1e95aaa3f4d6aba56748fcc2c7c79da83f79c1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a7b737-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324461, "uuid": "e369cdc0-5f7b-4be9-a6f6-983551c10d50", "comment": "Malware payload", "value": "1d7601a00239d2a88e25b99d1ad156cb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324461, "uuid": "6dffdbb3-bce8-4415-84b9-5654cdecc850", "comment": "Malware payload", "value": "4298199643f6b5f7ca53e19cad60d3e210ccd0d809e3c2878b1ecb8afa1d2984", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324461, "uuid": "e77fa330-ebe8-44a9-b918-360058201598", "comment": "Malware payload", "value": "63fb22486d9ba5111c7e3709f32d6740014e2175", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324461, "uuid": "3b43fc77-d6c8-48ad-938c-c2f36ba1e884", "comment": "Malware payload", "value": "42bc40697d36534c1063949c4ace384518219317d862630dc7fcf6ab88d58853f22cd0fe0531a8b80e3030d94380f4b3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324461, "uuid": "b1a8d169-4b78-48fa-b9ca-6c9997f3df35", "value": "T16C21D835D83DD7A1F94F1F34B4A0F5451E3E922A11C792EAFB5874471909978874D610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324461, "uuid": "5134bd8f-3163-4481-bc4c-ddde904c4871", "value": "24:9VnuYo18Mw1XIv4tBg5FGFXdY8RyEIFNdt0mkmMhrwUE5j/0R2Q:9Vut2QvsBg7WXacyEIbUTvDej/Mb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324461, "uuid": "23ecea13-b821-40b2-aefa-1c7858915b5d", "value": 1380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324461, "uuid": "bc68b039-1955-4585-9004-29ea52e9d56b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324461, "uuid": "255657c9-c007-49c3-81a6-72adeb4f6e78", "value": "photov_312392808540.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46aa0064-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785350130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350130, "uuid": "6e41d227-45d9-415d-8de7-886b22098298", "comment": "Malware payload", "value": "bc51042da49cd3b13087bbb16569c9a4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350130, "uuid": "8dee60c2-6d86-4f8e-b33d-fa5fa8424fe3", "comment": "Malware payload", "value": "42bc3ec5de505d5d3fa1fe147ee88418848186373be7a3479954cf57a4ccb4e0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350130, "uuid": "d97966d0-004c-4c58-91d2-9394bce44e89", "comment": "Malware payload", "value": "10805d55fb99dcc189e9025c60aac33075847c03", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350130, "uuid": "a1af9ecd-a964-4c9d-a37d-a1326c8d7b0c", "comment": "Malware payload", "value": "80788d4ef201ae9aa66f6fc622633d76ca4aecee908ef7cf811c1ae32ea8df61246fed0eec4ba024fbabbfacac4f32bc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350130, "uuid": "a45112b4-424b-45ff-9380-ebd377eeb8fe", "value": "T175236C652A857C14AA98C4371D7E2F0CB9AD43E6320492ED7FCF3CF68C4A69DA11871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350130, "uuid": "41e13c32-d21b-4a4f-8d0c-8c325bf90063", "value": "768:hXOGVvX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:dL4cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350130, "uuid": "6b190fbc-a852-4cfe-a8f2-145f8929da38", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350130, "uuid": "7220dafa-0304-4382-94f1-d61280ce37f0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350130, "uuid": "9e22e5b2-36fa-4c4b-95c3-cd0e731860a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d192e491-8b6f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785344779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344779, "uuid": "f387f55d-df9a-4931-9340-844920e9ac10", "comment": "Malware payload", "value": "f690e8a32ee0d9c7f913f77e5bfa2af6", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344779, "uuid": "f7a4fcc8-b326-4359-9e41-a5439a3e3ca1", "comment": "Malware payload", "value": "43b37c505bf661804a0b9a117a8875c47ae74bfec8b9d61d74dbc636716923d1", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344779, "uuid": "d9f6c8c7-cdd8-489a-86ec-4b63aeed5ef3", "comment": "Malware payload", "value": "3000e47568e5a84a90900b90f90074415aa642bc", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344779, "uuid": "9b8a8ec2-e88a-4e27-ba93-8d8c36a0ec6c", "comment": "Malware payload", "value": "d26cd65bccd76e066c7e140fd2714b8b95e3c747ca8d0da9bf9e2a822d3e8031da7b1fc45f6f68a78409a6d13a554ecf", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344779, "uuid": "1fb840fb-ff56-49f0-98dd-87c936c7fb03", "value": "T106844B3839FB5019F173AFB95FE4B49ADA6FF6733706A45E109103860B23A41DE8153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344779, "uuid": "f163fb42-2d64-4cb4-a2bd-003640820eb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344779, "uuid": "2a00aed0-670d-4661-9e81-322ea953c30e", "value": "12288:WQsLmkDqRAlCmear55ZMDSaQsLmkDqRAlCmear55ZMDSU:/q6wdq6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785344779, "uuid": "9589bca3-9d40-44e2-9856-2e863d183a93", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785344779, "uuid": "a35c0bad-821e-4e0b-b8cb-c4fc045b559a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344779, "uuid": "4b0b54c4-c47d-4af3-8854-3b6a84188c96", "value": "EldiaLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0520c13e-8b65-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785340141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340141, "uuid": "b6c081d6-4137-49c8-8a69-3fa9e244966a", "comment": "Malware payload (AgentTesla)", "value": "529a4e8314130d9693118be4e2ed9c2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340141, "uuid": "e5b14f32-3ad5-4b24-afb8-45ab08287d93", "comment": "Malware payload (AgentTesla)", "value": "43e782d8c5b308ecc64aa65004d0165ff2ef3a0be3c659a2a02e1a4b5777094a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340141, "uuid": "19d152d9-ecc5-467a-aa12-c5430ea9d397", "comment": "Malware payload (AgentTesla)", "value": "1666811709b9905e72f7065703bb176b149525e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340141, "uuid": "2c57badf-3513-4077-af80-59b749b39b37", "comment": "Malware payload (AgentTesla)", "value": "cd51957d769d99b157179cdca9a20ac1a02eee6f8256d1e7c4d6ab36251de39faf6e8f7657b0437fc5559ae66e137f2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340141, "uuid": "132062a4-8f03-49d8-9144-a3900a3bd894", "value": "T10184CF9AFF70E8D2C93C0A704B7789250636EF940A51472B2A54F36F7E726029DA7F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340141, "uuid": "92bd1405-9929-407f-9969-64cdd4e10873", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340141, "uuid": "6945c9a4-0e3b-4e96-b67b-988a98522c44", "value": "6144:D+MvoJEiU4oWwomiaZvNOTTGi0PhFKdLhyTCdijLVHE+A:D+e4oWwomiaXO+rLWdijqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785340141, "uuid": "3bf8771f-fcc4-4f6e-ab1d-70e2e37b2ca6", "value": 381584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785340141, "uuid": "f30d0c61-97fd-4f7f-9a95-e230e29d5429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340141, "uuid": "548ba65e-78cc-41e4-86ce-92a292e2b287", "value": "Documentos.xml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba3525b-8aed-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785288935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288935, "uuid": "d916d938-7c93-48c4-b5d6-a15cc03bf301", "comment": "Malware payload", "value": "67965bd0cd526b0ac5862e5ec90b6084", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288935, "uuid": "0938a67f-0d9c-403b-9373-c3d3fd88cc35", "comment": "Malware payload", "value": "441cb0179c91c4c36cbd05b75c6b9b8bd4a668518bceb7ba028a0b077d2a14eb", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288935, "uuid": "123001a8-187b-4229-921f-7ba2fc7a5262", "comment": "Malware payload", "value": "666851917aaddb876ecb24818c5a6029da0e868f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288935, "uuid": "d3e1217b-5a96-444b-a894-bfecabc4b09f", "comment": "Malware payload", "value": "aa3d6500589349d8c08a86a89f595e93528918f4ad44015eee8b26735eed184dfc6a6f5a7ef7ea88fc2abc8fd0db9e64", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288935, "uuid": "26174ccf-3f4d-42fa-9eeb-4c513d8ff3e4", "value": "T1CA2733A62C262E83CA5466BB23531342AF310DB33B1247412D7DE92D1CBD1FA5B5D39B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288935, "uuid": "02cb4d56-bd30-42a4-ac0a-a198320f3c28", "value": "393216:5jcQb0kS3gllQv87upa4GCAKUd2Cu3et11G+ahvcThiY:5akpC06ZA7dpIeRTUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785288935, "uuid": "3b418e3b-576e-4125-bb4b-17252d79eb54", "value": 20365312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785288935, "uuid": "1bc148eb-7122-4d48-a887-92c3c3fdf117", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288935, "uuid": "309aae0b-4464-469e-9eb2-a655539a1b6d", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39838c88-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307158, "uuid": "917c316e-0a44-474e-a33f-4bdaaf8994d8", "comment": "Malware payload", "value": "2195641a45c95be8a3a2436f621b0905", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307158, "uuid": "56d8355a-afdc-4ef2-b38f-ba6b19aa189b", "comment": "Malware payload", "value": "444c17dec37e72ad5998e3347e8749ab8af0236c2aad7db29f44ddc4bb3b1bde", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307158, "uuid": "df9d3a50-a10f-461a-a134-30feae2d6b1d", "comment": "Malware payload", "value": "eb7b4637b2ed7d333685ba3ecc17b25face07c87", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307158, "uuid": "7ddd4ab7-fa57-409c-9b12-227d643ea35b", "comment": "Malware payload", "value": "e8f5859606dd84429260e4f619997c689d2a4a90cc01a41a1dc317718807d140ded9362819e77cbcb87aa85f4eb36082", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307158, "uuid": "c0c9e3c3-2327-45a6-9344-0f91d883d09d", "value": "T19772CF73204AC8F5F6054F32038A3AE52CADAC12D257A55E7B5560B08D918F7257FFA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307158, "uuid": "38016fbb-b956-4fce-9d92-0f989c5571ad", "value": "384:4rV8GvkLLKa5ux5lIOawoXdH6msRGWeoPGMz7CSsK:44Qx5oXB6vRGWe0hsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307158, "uuid": "642936f9-0252-48bb-aaf0-da1981d42802", "value": 17273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307158, "uuid": "f7b14962-9f8a-416a-a87b-9152f94ac8cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307158, "uuid": "448f0a93-de4d-4820-8387-24decfb22ff7", "value": "images_20260728_092137.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ede153-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333033, "uuid": "51c53a67-38b5-4948-8872-48196e12ce22", "comment": "Malware payload", "value": "3c8c36b54f49e3b19ee4740b5d3d3068", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333033, "uuid": "2c27dd63-8b38-4dbe-b3b4-82a87a5fc46f", "comment": "Malware payload", "value": "4460e3c8bd2d7843008ac46c66654f7525f6464cc156b8caa50b0bc072844878", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333033, "uuid": "ed9e70ef-51d1-48dc-80aa-91ba54922b41", "comment": "Malware payload", "value": "0e7721755c45125bf3f430dd9d22db529fdb0a61", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333033, "uuid": "b1625615-bdba-473a-9d41-fbd3488d65d9", "comment": "Malware payload", "value": "e4051b28bc7feafc4dc86b9166fc9ad5d62c3600b8556f5f21d7e39899673736729d48574a8f7919abf6627bb9ac1f10", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333033, "uuid": "5953f80b-59b0-43a3-b6a8-1e1193c76f95", "value": "T136B271B47521D87C7A9DD63E1213560831427487A405AA3CF4CEB8685FDEE2C23F6BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333033, "uuid": "70414d8a-22ad-4355-a3a4-bf5fd6119bbf", "value": "384:CtpB/4qRR2Vf/qRRcbLs+mW4S1LK9bM0BG4/HRE:+p46R2V36RcbLs+mWLxK9bM0BHHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333033, "uuid": "c794af03-2237-411f-b0bb-7f7ae63819ac", "value": 25001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333033, "uuid": "2649790c-f7e9-480e-888f-9d3ba0d7373a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333033, "uuid": "aed148b9-e55d-4f21-ac1a-a96e3af216fa", "value": "setup.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9cafa3-8af8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785293552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293552, "uuid": "041291cc-d0cc-4841-a63e-3ac852bf8fcc", "comment": "Malware payload (Efimer)", "value": "1c469916e01f1764882d32285e439344", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293552, "uuid": "2b5b0bf4-3891-4791-a45c-322bbbc69341", "comment": "Malware payload (Efimer)", "value": "44df3b2362cac083812b2069678032b4b2dd91589023f9bae4fbd3746a23b1f9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293552, "uuid": "b2e3db3a-8933-4362-9534-410acc934f56", "comment": "Malware payload (Efimer)", "value": "6169ac3ced1b02027325a3ac80577ce536572bfb", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293552, "uuid": "ffc2786b-3f12-41ed-98e0-9551c7f74a11", "comment": "Malware payload (Efimer)", "value": "1feaa3ea7c8a2a8573e3038bb8ca1cd4e5da7fa200f640e47d14fcdf6c68de16c8b7237e1bef5eef3b7b2ceeeb407d10", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293552, "uuid": "c09e0035-ca05-448a-9de1-39e0eccbdfec", "value": "T19CE633487ED001EEE9F3C138AEE15299D6B678B40BB3C9CF17A463A95D1B1E0453E247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293552, "uuid": "50085e6f-049e-4a28-81b3-312151175a10", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293552, "uuid": "970cc599-412a-4b87-a86a-f1d345931c99", "value": "393216:kHMb7T1cSqhKqmWtCHxUSwXMCHWUjXQcuI3/PGTAI:ksb7T1XEK5WtCHqBXMb8XFH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785293552, "uuid": "134a3d27-ebe8-4126-aa4e-c44bd9894325", "value": 14316806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785293552, "uuid": "d1c24c8d-1f24-444d-9d24-c1f06fd4a3be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293552, "uuid": "180d663a-856a-4aa8-9580-f893ae003c61", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f1943-8b16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785306230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306230, "uuid": "7db43d5c-f565-4189-83ff-62cd51081e3d", "comment": "Malware payload", "value": "73adaea97f003735335505858c1c6def", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306230, "uuid": "4b08d7de-d59b-4050-bbaf-e3d7dbbdcb43", "comment": "Malware payload", "value": "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306230, "uuid": "1aef5b9a-ba80-4aba-90b5-96774081f728", "comment": "Malware payload", "value": "d81081691c3631f3adc1a6db0ee22ab19682ef30", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306230, "uuid": "9c23b182-bcbc-4377-819c-93670e9ba4b9", "comment": "Malware payload", "value": "5d0db17ca7f541cddc6825999780bf2da8a0a76f703d4c0c71fe1ac1fd42b5cee72306784d491d9fccb58d8f40de8ce3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306230, "uuid": "bfbeb4a7-30a0-4ea9-b327-ee7071491d49", "value": "T114C185E3F08457742259C51CAF8974044A9B053B48487E4CB96C72643FB8F25B279BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306230, "uuid": "212547a6-9ecf-4076-b86b-4cfd49ce05a9", "value": "96:6Kpb4yyuDPDsTbCF+p83SWeklyjyCuVZf7kmgPFylxwARy2RZA:6KpbXyuDP8p87eay+Csx7kmgPFyj0UA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306230, "uuid": "758c924a-8815-40e8-9455-75612c55e18d", "value": 5621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306230, "uuid": "632091b6-6846-4796-bb0d-849b047fb995", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306230, "uuid": "f24f7ee2-2452-4791-ac75-11b0c383d894", "value": "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e1837a-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305239, "uuid": "1dd23e3c-1478-42d4-9fb1-8b9773da8f34", "comment": "Malware payload (Copybara)", "value": "298a6d3c18508b7ccab7fde444ddab1c", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305239, "uuid": "4cd9ddcd-0b9d-4f32-a228-e0923e7279b2", "comment": "Malware payload (Copybara)", "value": "464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305239, "uuid": "764e0aa3-66c0-4005-bb49-15a4427b1eb2", "comment": "Malware payload (Copybara)", "value": "91320edbb7598d36729ce90ad7f948592d192c53", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305239, "uuid": "5cd7d8f7-0c22-4ae3-b39a-258180548f07", "comment": "Malware payload (Copybara)", "value": "47f18f9e7c2c32255d298dbdbda96aae49e8666e7ebfd584ec22468b7f94eab0faa997fe1b7ba0c510d2bb9cc1f74577", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305239, "uuid": "431aefca-2c86-4927-ab4f-20576cbfc933", "value": "T1EDD633061E07F9D5C2B14C73ECC294788CD12F4446CBE4549DAEE9DA28BEBB5D22CB58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305239, "uuid": "24cd5143-bf97-4daa-a926-3773eeb1b06c", "value": "393216:G22Cv1A9+RJmJdOtyr+rKqe1Pt/QKwn5hu8:X2CvOFn+uPyh7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305239, "uuid": "df506579-db1a-49ad-b73b-87c1a745004b", "value": 12653931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305239, "uuid": "19a91cf5-b6ac-4109-9dd1-ca4cb1755e3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305239, "uuid": "0598043c-4bfd-414f-97ad-12575a53b232", "value": "464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c837d6f2-8ae7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785286352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286352, "uuid": "8170b234-e8d2-4d36-8662-211130db6faa", "comment": "Malware payload (Efimer)", "value": "9bad6907be1e22a4cd2eb198d921ef57", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286352, "uuid": "ac7c2e51-370c-4a26-95bc-97a5a990c54b", "comment": "Malware payload (Efimer)", "value": "46eb8bc5b1f257520507bb81b2d010ea9d5a56b1843c0168953f3662b53d7a15", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286352, "uuid": "f7713a5a-5bee-4f77-853c-efed2cac0b62", "comment": "Malware payload (Efimer)", "value": "23637b17c84bcf8ab0763673ec6935fccaac9048", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286352, "uuid": "7fb8b173-c402-4847-86d2-e47ec6877c29", "comment": "Malware payload (Efimer)", "value": "47358ad41b224f14e8b41d793e2f88c7e490ef9266a07a3b0fcc75c9d2cb94a50b1ac8639f7232d052f98e4eef2c21f2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286352, "uuid": "27e091d4-103d-43e5-b45e-07b9fd982396", "value": "T1E7E6338896E012EED9F3413CEED26654F12978711B32C9DF5F4893A53EA71908C3D62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286352, "uuid": "b63af9c4-af41-4b30-b670-79ea7e0d97dd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286352, "uuid": "d0a26a75-9b41-40a2-b2c5-c78ed49fb0d6", "value": "393216:ZhIt98Pj+d5YOXuo7VnANqXMCHWUjXJcuI3/PGTAI:ZIU+d5Vj7ZwqXMb8X+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286352, "uuid": "6c951861-b673-4ffb-9133-8d0aa8e7fc8e", "value": 14322979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286352, "uuid": "9109093b-9dd9-4416-bff1-4512cb8a9dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286352, "uuid": "c4d69d10-33a9-4a72-82dc-29e787e0fdea", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98793de2-8b3b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785322350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322350, "uuid": "b1ba68e0-87b8-417e-b17b-302044e3c45c", "comment": "Malware payload (Efimer)", "value": "2ecf35ea5f805a9ae32af7b6d6cc0507", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322350, "uuid": "bc420784-5bd3-4d7d-82cd-ca13fccb359b", "comment": "Malware payload (Efimer)", "value": "475e69baae47f29ca6e4689e5953926b5a1357d69ed8e0022b85804cff62d51e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322350, "uuid": "346122c3-ef40-461d-960a-a23d97b33693", "comment": "Malware payload (Efimer)", "value": "66b099d5fec7b87ed4e4d82b54f8f96d1ce07774", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322350, "uuid": "ca3c508c-17c9-40b0-931f-8ffd334de3d8", "comment": "Malware payload (Efimer)", "value": "31fc3c17e73b1a30907e969398efeeb8acfabf218025856aedd31d660043a887dc780f190fa91924e1c79eb004085a4c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322350, "uuid": "2c63700a-fc99-4547-88f2-9190632578da", "value": "T1FBE63398DAC512FDEAB3403CEDE16686C1A9B8745B71C5CB47F88395AF071908E7CA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322350, "uuid": "aca7fe87-4bc4-4f1e-84fc-85541e7836f6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322350, "uuid": "0a59a904-ef8b-4b9b-998c-9c68a02edaef", "value": "393216:BdYnvBccqhw+RFqXMCHWUjXfcuI3/PGTAI:Bwv6cwzR0XMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785322350, "uuid": "e801a1b8-8864-46b8-b2a9-f5ca898a047d", "value": 14307320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785322350, "uuid": "dd6b1028-abc6-44df-9d4e-a164daa8aa5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322350, "uuid": "5df51405-58d1-4f81-98bb-5080a12ac1e1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ecaa32-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323869, "uuid": "97556c08-605a-4aa3-b090-eb1f84e31b4b", "comment": "Malware payload (Mirai)", "value": "cca25ac0fca38163806fe4674ed35016", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323869, "uuid": "3012b59a-83e6-434c-806f-eb4c02a74590", "comment": "Malware payload (Mirai)", "value": "497a067b6a911e187d21bb71e03c38892c5227700b35809e4526f583a4df007a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323869, "uuid": "86735010-a22b-4e6b-ab3a-a2414353a493", "comment": "Malware payload (Mirai)", "value": "44f74f1e614a97c1d5acc2190eb96465f6be8689", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323869, "uuid": "42f6512a-8d7b-4e81-bded-28ceb8fde6f4", "comment": "Malware payload (Mirai)", "value": "3f29283da234aed69ccf098387b0052014068f135be763dd6385ff54ca6df3f79b4369ae516932f63b8cddd99cad9070", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323869, "uuid": "b9be1e0b-7085-450f-82d0-f7ed34844869", "value": "T1A4310A8A2B876AD93F2C6F26B949C71C63494DDDE8127BC4F2DBC8705DC06C27C08666", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323869, "uuid": "fdb76281-1342-4db9-8241-a9e375810217", "value": "12:3J3zIAQzI6nREQzIENNIlvHBAQzItEK3HQzIReQzIVHeqQzI2N6ZqQzIhQzIrKAY:3J3z6jdNIrBK4IZ9bkXXDM9EPHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323869, "uuid": "856abf23-ab09-49f9-b78a-2f9663ba5610", "value": 1774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323869, "uuid": "ff05c4a4-63bc-4d6f-a658-d8eec6453a41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323869, "uuid": "77705555-a790-4797-853f-3709c1d46989", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96250bb9-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324493, "uuid": "f463050e-0c60-4e8b-af20-17d64611735d", "comment": "Malware payload", "value": "2d21767d0870eae451e6f335ce539b47", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324493, "uuid": "8e95a844-22ce-4961-b881-d6adc4282708", "comment": "Malware payload", "value": "49a8507e58f1ffbfc025d406a6fc9fa3ccc9f70e14ba46d40e5240529eca9e2d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324493, "uuid": "d21d6122-1f09-4de5-9142-741f3c099712", "comment": "Malware payload", "value": "aa243d3f8a446fcfb0697a515981260f45c44fe7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324493, "uuid": "78a295f9-ab82-45c8-81eb-2231a5c077eb", "comment": "Malware payload", "value": "749c51afcded1abcac3db5148145b3b71c375c1dcda61ed68d4b8484733509bf49a226e243b52abcfe0e052bae7765dd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324493, "uuid": "906bb860-8580-427f-8e0e-956ddfbb35a5", "value": "T16821EAAADBDCC1F2C87BF4377D22541A30D42B9941C57AED46E416ECFCC4846A312C14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324493, "uuid": "8f3d53d3-f9ab-4bfa-89ab-0deabce77158", "value": "24:9u4eDKBl8xXl27pyISYOndjmgvmk+nSNbX+2mwnNQu8jf3IGnTn:9u4eDiU27pqYOdayT16S1KTTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324493, "uuid": "c0d2678d-4d86-4c5b-a477-2a852ee4d835", "value": 1333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324493, "uuid": "d016e5c6-ab60-4cef-b6c0-63f4b2580f45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324493, "uuid": "21992574-a968-47a4-ae20-3ee2519357c0", "value": "photov_001127393551.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c758f135-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313838, "uuid": "766035aa-b0ac-4f3a-aded-ad08bdcd0a81", "comment": "Malware payload (Mirai)", "value": "d8f2794d6741b1dbcd23ca2e30049c81", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313838, "uuid": "a1ba8f18-ce91-48e0-a9d5-56e28f3659bc", "comment": "Malware payload (Mirai)", "value": "49db1bcec605b3ec136d27cdc4f5ec6856fb5ef2c8f8f788688769ddd0929e2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313838, "uuid": "de5bd2d6-7afb-43e2-90c4-2e6ac50dc275", "comment": "Malware payload (Mirai)", "value": "b4415ebb47ed29b6e32a331a6a30c535d84c21ef", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313838, "uuid": "b118265d-93ed-4315-afc3-08863760396a", "comment": "Malware payload (Mirai)", "value": "d61dc8e3174e58de821a2cfbc895fa1e0fa01b9c9a015c0c105fc1420e6aa9f21033de1442454924af903723ea0eb306", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313838, "uuid": "199236e1-0b6f-42d2-a280-a2344c569251", "value": "T18363079AB8818B12D5C512BAFE1E118E3313177CE2DE73169D10AF2077C796B0E3B856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313838, "uuid": "cd35433f-caa8-4a4a-bf32-4d90ba605d4c", "value": "1536:4Nn1wVfq8wCnd5fnAZcHNPUyI9ibPQzAhaCLtdOQF5cY9:lC8jfACPQzAhaCDvFiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313838, "uuid": "1beefd33-2433-4852-a9fa-073af07ff689", "value": 66856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313838, "uuid": "bba41faf-1564-45ec-8506-2c3b5132c1f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313838, "uuid": "94ea24ab-a399-4a19-b270-045c9451676c", "value": "real_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d02fe09-8afa-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785294360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785294360, "uuid": "c767ed1a-a46a-4a30-902c-4037f73f4865", "comment": "Malware payload (RemcosRAT)", "value": "d2183f36851773f9cd4fdbc79e3eb1ef", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785294360, "uuid": "62b8602d-f021-487f-a53e-19a648c5b77d", "comment": "Malware payload (RemcosRAT)", "value": "4a6450f5a3676568e1d3d993d1c6f908af7ca07c41887bf48d1ae9672fc58512", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785294360, "uuid": "4a7b5722-ad43-4651-8683-3811635b03f0", "comment": "Malware payload (RemcosRAT)", "value": "b20254344d0df6cf8bf08a8e3c55a0c041cefded", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785294360, "uuid": "e0adb622-9d0c-4000-8413-fdbd80900529", "comment": "Malware payload (RemcosRAT)", "value": "33d0b7aead0243ae610fac1503f12b4c8f856c32f983fea7b61f035ec481b64758e1c6fd03a77fdbb3580f5e9b9c00f6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785294360, "uuid": "83bfed4d-c2aa-450f-9ff3-0e25dd05df41", "value": "T1DD441720DCD80B3A0E5707DDFE510A65C9FDC5298627D0ECEA9E171E50125ACEBBF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785294360, "uuid": "c6ead93f-d929-4be2-95ef-67dab121c292", "value": "6144:FupSvRhXaMj2WSUYVrNpX+ChnQ+4U9RggxYsTQ:i1Mj2WinpzO+ZYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785294360, "uuid": "7d19ccec-4cf6-48eb-b95d-5b47a0c5d8b6", "value": 276490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785294360, "uuid": "c7c863f8-fd08-4a43-9356-681e5dfcb363", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785294360, "uuid": "033090c0-ff8e-46ef-a903-e21ed7e1ec7e", "value": "7556TH364640.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91370c2d-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307305, "uuid": "a3db7bed-329d-4ac7-8beb-e0d926145a27", "comment": "Malware payload", "value": "6e400e741ac695e4b90225da0e372894", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307305, "uuid": "662a5bf2-e6aa-4b8a-8bc8-64ef425d7099", "comment": "Malware payload", "value": "4a7406fa7cd9d1223b927292671eaa4767008ebb1c3ab0fec77a0e8ea9c27240", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307305, "uuid": "4df9f2a7-0ccd-4a2a-b405-aa77832e4a0c", "comment": "Malware payload", "value": "4b612a8b55ef283f678efa85090a6194d90f20df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307305, "uuid": "01fffad7-c42b-4889-a389-929b8c4cecd8", "comment": "Malware payload", "value": "b01451279dd8d4ae393bc4ac7b2ef6d09474c6c2eadba65c4fe13f862b6ae77a3a13bf7042392fa258d7d49c2a2854b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307305, "uuid": "d00bd1a6-757a-4c29-93a2-a8dee9950db2", "value": "T1EF52BF741FB05266FE6FB17FAC41ADEF87FEB5A88593D545E8D8170AA9861800310C52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307305, "uuid": "5b707f5b-8598-4ad0-9256-f8280cf4c69a", "value": "384:eIj5/WDyWHl2EtisF210zpHD7R315R6G2PU2+crroumB3L5X:e85/WWrEYOo0zpHPUP9+dBFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307305, "uuid": "7fc047eb-97f3-4f3f-98fe-0432ddd3bc91", "value": 14219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307305, "uuid": "a69a9f25-f5ce-485c-b0d7-a8cd67847f62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307305, "uuid": "708ea780-4037-495e-ab4b-5ec71ebced5f", "value": "images_20260728_172436.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cbc5344-8b69-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785342033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342033, "uuid": "333c49fa-2f9f-4f81-8afa-0a321b1036b0", "comment": "Malware payload (Mirai)", "value": "0df37c3c2cd84026e78527e6daf265cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342033, "uuid": "c46a16ea-3190-4c2e-b2d2-6b3a691e9782", "comment": "Malware payload (Mirai)", "value": "4ae8ca363d5dabce54deb29394ba21ca5b5a6d1646d1063c42c453567f40cdde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342033, "uuid": "92263e3c-f750-4d27-92a5-305a4f5551e1", "comment": "Malware payload (Mirai)", "value": "023af4974c5056bef452a4a557523f4516b6755c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342033, "uuid": "560d1ac9-d2e3-492c-804b-f8cc226054ed", "comment": "Malware payload (Mirai)", "value": "583e170f21d0970802045cf8ae08a853e54d47ad61d1de8a0c15b983541976032d82430eff45e37aa4e72cd6828d2288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342033, "uuid": "f222b67a-6d86-4236-84c2-fb3893314913", "value": "T13F4302BCF5C23DC7E0E7C4BC008507F35CAA1956A159D88A0A65E7E2DED47B63486F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342033, "uuid": "c18bbb75-3163-4f53-ad70-5cc305fb7e97", "value": "1536:EM/SZqOKejFZMYEN1SrZm7jaRp1tCSKrPIVJurP:FSfKYzMNna6OlNcIVQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785342033, "uuid": "a54804a8-9ee6-41b5-96fa-b3ab4cf04273", "value": 60560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785342033, "uuid": "427191f4-a5a6-40e6-9671-7c97fb2df8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342033, "uuid": "87777959-88da-42b7-b240-a01340963d83", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb44363-8ba0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785365551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365551, "uuid": "39181111-48ea-4122-8032-dd496c73883f", "comment": "Malware payload", "value": "aa7a740a167d36f5ed71bb52478638d6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365551, "uuid": "dabbc9dd-ca65-401f-bfa7-6b2c5bfffc81", "comment": "Malware payload", "value": "4b2bfcdbd2235a917786405381129da36922bbbb3f0342fbe44eaad3760afaa5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365551, "uuid": "30b8a82f-b4fa-4639-9259-7c17ba7227f9", "comment": "Malware payload", "value": "6b58b9c15452ffe1a3178c79d77f0a93e8d0d0ad", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365551, "uuid": "faa8f85b-8601-4f96-bae5-0e3773d482ca", "comment": "Malware payload", "value": "08eac6ce165a8068a7f9df7b2ba13f5b6355b3042e033a56401c49b09b8abeed979a6c39cd32cfe169c1edff9b92450c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365551, "uuid": "1e774646-5c17-42ab-8cb7-110b713c643a", "value": "T1AEE633546BF122FEE4E3103C99A155E0E156B4690733C9FB07A0C6B96F5B2E09D3E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365551, "uuid": "5c7f4346-5b43-4964-aa94-079ac34eef61", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365551, "uuid": "39449153-71af-4c9d-b97a-96de3b8c5572", "value": "393216:b8FoPHL6mXElIC4xg/UmQXMCHWUjXFcuI3/PGTAI:bMoPHJX7C4xeDQXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785365551, "uuid": "032f0ab1-373f-4d13-885e-36aef9b8c6fd", "value": 14281966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785365551, "uuid": "e543b872-8901-4082-87ab-26383b97b287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365551, "uuid": "5537ac66-0535-404f-b347-f380d54e7c6c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bea907-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324498, "uuid": "07d70d85-2d55-4936-9552-96251acdabb6", "comment": "Malware payload", "value": "7ee75ebd338dabf24197efc3e8e06cfd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324498, "uuid": "d7178f46-3bc0-4f23-a690-cb16b1afa65c", "comment": "Malware payload", "value": "4b89913b90dd9499d8a462849f849b1f69cb84bf5b4ee0a8410a88ab1407ad2f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324498, "uuid": "ea1d6a61-8e3b-4717-a7e1-c9775236394a", "comment": "Malware payload", "value": "9fa1d4971a870a6096a19259a18bc17f451da5bb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324498, "uuid": "e241bf42-e570-468c-91b8-534e177e46f4", "comment": "Malware payload", "value": "a553b614dc19d168f34d07915023bfa61533a8ecc4435372475506a5ad7557a1e8495f00830067823b09091e78d925a1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324498, "uuid": "00467729-0c39-41fe-8b2b-5f761496fd1a", "value": "T14321C8A5C05AC448D1AFE635F93CF94A2057227514080E1EAAD983832C1BF59CFAACC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324498, "uuid": "340c544e-6c2c-44e6-9c15-9ac174981355", "value": "24:9I3CTjWpfmw2VuvrlLQmQV2zlrrV1RFC+dKhfkXHtmknoQv0ubjH6c5eZdGloBU:9I3SjWj2VMrdq8ldrIfkXNTn1vlbDJY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324498, "uuid": "0e74615e-8c96-44f5-b32f-4d23e433bece", "value": 1350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324498, "uuid": "7820e0e6-91ee-4022-8392-36c892e530d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324498, "uuid": "086fbae4-154b-4524-a874-4fe49554aa07", "value": "photov_792573520721.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9116d3ba-8b6a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785342524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342524, "uuid": "d6f48b81-5df4-4203-a602-f8a1c8cb8bf4", "comment": "Malware payload", "value": "6b735c768cd00f238b11f13fa8131064", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "RvTools", "colour": "#AB53BA", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342524, "uuid": "8311b6a5-cd18-4a77-9f48-59e000c8bd11", "comment": "Malware payload", "value": "4bb5874756ee936ddbb02d110a4ff1c273496caaa43531e353a0cadaf4c7fabd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "RvTools", "colour": "#AB53BA", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342524, "uuid": "0b29c3b6-27e6-49c8-8fc2-f7718ca89861", "comment": "Malware payload", "value": "2e2027a3df4fd30e26c1223b2abf36b61daa09e9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "RvTools", "colour": "#AB53BA", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342524, "uuid": "f6235915-d1f8-43c9-974c-e3165af29da6", "comment": "Malware payload", "value": "da8761d8abe66580e9ff831cc744bd3eeb7d5313ce023a7203d5d56f9bc8ac825d54e732e6904f7b5f4fb195a971cc80", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PythonRAT", "colour": "#C84036", "exportable": true, "hide_tag": false }, { "name": "RvTools", "colour": "#AB53BA", "exportable": true, "hide_tag": false }, { "name": "smokedham", "colour": "#34B3D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342524, "uuid": "8a6758b5-e82a-42a7-897f-5ec6b2e34ac1", "value": "T18EB623D7EBA149E4D1A35C38127E6607D234380D8218997BF3DD5A913F36798A8F8B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342524, "uuid": "0bfe5820-e5a6-439c-8514-fb1a58600811", "value": "196608:JJ0J36ikBL3FccXm2Hnzesf/2HB7wM+2EQ6LzT/X:1Vljnzesf/Q7wQOLzT/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785342524, "uuid": "4595a4af-0ab6-4865-a982-5ae2ae015963", "value": 10654208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785342524, "uuid": "a4e023d4-9a0c-479a-9d49-2be72b0bac56", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342524, "uuid": "d130c7f0-b772-4408-9015-d19e931a2a7c", "value": "rvtools4.8.1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42409c51-8b32-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785318340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318340, "uuid": "2df59804-80db-4eb7-866d-b6cbe0b69769", "comment": "Malware payload", "value": "575ee3c0d096079f5361ae02eeb874ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318340, "uuid": "877e25df-1fee-4ed9-8c1c-2c9a764fd1a9", "comment": "Malware payload", "value": "4ce994747eb5fb4113f23d42f22a089e099c6690980dac9c92d26a28762e25ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318340, "uuid": "8cc7e83a-f311-4590-a281-d1062b40bcc2", "comment": "Malware payload", "value": "c5c25a0381af10a7117791f7b217badc3001f2a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318340, "uuid": "66deffb6-4634-4e33-bb9f-8744a7ddcaa6", "comment": "Malware payload", "value": "d6092381dac6dd098ea00dc4264be6f1d2f2a8bee8857aeeae2b7cc011278517a132bd4c5b2c9b63c842ac656941d99f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318340, "uuid": "ba0e3d63-a838-4e38-8883-0fca50d605f7", "value": "T1BDF6333FB26C743ED4AB1A324673862058B7BB21A92A8D5F47F0485DCF3A5601E3B715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318340, "uuid": "99ec015c-3485-406e-9ab6-ee1d19c2eae8", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318340, "uuid": "bfe010e9-c07e-4dda-a356-c07d6edbade2", "value": "196608:jF/jZrC41P7QGCj6G/Q7H1YIZ9O48z1BE5PSz5MroDkXzjbIwolSQG62WeHVjFO:jF/91PhGIODVp65PS+rJjIAQEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785318340, "uuid": "12648ad5-18fe-4e28-9958-415b2e8d9b57", "value": 16493090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785318340, "uuid": "fed42153-5ed8-4097-8028-d96ee9312456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318340, "uuid": "c22730ca-ca0c-4eba-9f4c-22acb80a3990", "value": "Tence.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50644e60-8b21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785311062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311062, "uuid": "d0f77cce-20b2-404c-ac07-5c65fe104e95", "comment": "Malware payload (Mirai)", "value": "afcbcb0763439fbb72f8c66748189047", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311062, "uuid": "39836308-9056-4793-a820-cf0c5c70d632", "comment": "Malware payload (Mirai)", "value": "4d0c60de311727221932fb0d9c639b98a677aa99e1af4055fb4f2f6124be5ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311062, "uuid": "0ab272a8-ab7f-4a7d-84ff-6105a81029ce", "comment": "Malware payload (Mirai)", "value": "efacf1020bacfea838c256d3612d3e2d50905462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311062, "uuid": "7da27317-f6ce-4a0f-9685-147ce077a2eb", "comment": "Malware payload (Mirai)", "value": "6b15b06680cf66a4ffcab6530bd7648937640d2479c77ce8976fae4cc0bd5923521a4b224753700ea77d962282c0fcdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311062, "uuid": "db1c8950-c72e-48ee-9a64-842ec3189101", "value": "T1F773D906AB550EFBDCAFCD3745E9170235CCA50721B43B7AB974C918BB4A24F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311062, "uuid": "b2941b92-b5b4-4f7c-9d4d-8a9ae774f515", "value": "1536:DKE/Xb/an0dwMQF3iAOaKiI74b1OYc93VGOI0:+E/XbVYaxYcNnI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311062, "uuid": "e1385e77-28f0-4b89-860d-217439edc60b", "value": 80652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311062, "uuid": "ae219b6c-3cad-4602-bca4-75e5011399c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311062, "uuid": "c228d946-f318-464f-98aa-fab160ae7755", "value": "real_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ae4a58-8b5b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785336166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336166, "uuid": "c957b345-e5d6-41b9-86ce-5c17bbbd5acb", "comment": "Malware payload (Mirai)", "value": "9d5fb3590e2ee5ce69c6266a6d08e4c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336166, "uuid": "243d0a07-de7e-4b94-9e0f-319bed19cef5", "comment": "Malware payload (Mirai)", "value": "4d9d9274a5f607b4a04d6241b17b0bf447111f0c965c07f624a4deed906403c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336166, "uuid": "53485485-e4ec-4d99-b303-e1c167065064", "comment": "Malware payload (Mirai)", "value": "96de29215039839b32e3f9d5ca246f827044bb97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336166, "uuid": "d03890cd-f9c4-4d0b-8449-7c8d7ecaa460", "comment": "Malware payload (Mirai)", "value": "eeec4e092a99b275b2c740dd7311120df854fdf0409ec0489476167f35778531941ab7aff94fe3dfd5db15e2c2558615", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336166, "uuid": "e9e1432a-899f-46ad-9d24-61a0e203cef7", "value": "T1DF24E70A6F510EFBD8AFCD3712E9070129CCA54B22A53B397634D518F54E64B5AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336166, "uuid": "8ef7deef-cca3-49e4-a1a2-c963bf086dd0", "value": "3072:UMDDGZAI02uCs5dn9RZGSqxAdnAPs4t5U+7Z4vCD:UMDDGZItf5dnkAOsp+FqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336166, "uuid": "f4b81de5-e629-4a6f-bd08-921030b4baad", "value": 229108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336166, "uuid": "863783b7-54af-43b8-977d-05d30e09ae77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336166, "uuid": "e3c86b20-2413-4ebf-bfe1-e219ef91ef07", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9ea63a-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785321441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321441, "uuid": "2371e089-3ab0-4868-8b1d-e95503e5335d", "comment": "Malware payload", "value": "42ca2b5f2b2af66dde3b74b1268448e5", "object_relation": "md5", "Tag": [ { "name": "178-16-52-93", "colour": "#C7FD69", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321441, "uuid": "e2b2624b-478f-4f25-8fee-b9e6eaea5ce9", "comment": "Malware payload", "value": "4dadfe0d60ca295ca0a3865cccf3d47c09ffbd05f2e2d76a578e8d645ab72f6b", "object_relation": "sha256", "Tag": [ { "name": "178-16-52-93", "colour": "#C7FD69", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321441, "uuid": "af16a096-9979-494c-99f6-e1798f027c67", "comment": "Malware payload", "value": "402b84a4247407dfb1d2aa29ef22a05bc9afa0c0", "object_relation": "sha1", "Tag": [ { "name": "178-16-52-93", "colour": "#C7FD69", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321441, "uuid": "0c602a25-9757-46da-bc91-883d8f473cc7", "comment": "Malware payload", "value": "db39b1d6ba13db7fe40df34052f19bc58d49ac0f7ce331ee11aea40fc3323e112036343109f87e7522dc072ec52b044c", "object_relation": "sha3-384", "Tag": [ { "name": "178-16-52-93", "colour": "#C7FD69", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321441, "uuid": "24126a07-722c-4359-b7e4-c09d268806bc", "value": "T106033904A7CD9EA3C5ED46BED0E373E103F4D4B6630EF38B9D8902A41E217D66642693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321441, "uuid": "8c5a740a-1706-42be-b43d-79cbc304fb36", "value": "768:7zRsSIXKd9pdxWmE6SY/LKTo02jTtERNfnz+eJqUNbNCImy:vRsX89nxpE6pK0gfIUNbNCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321441, "uuid": "37938cfb-1970-40a2-93db-212be4bd21f5", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321441, "uuid": "30a415b5-bfa3-4e89-b33a-6ef7319a436b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321441, "uuid": "fdb03c87-e96a-42c6-9dbd-cd71d42c54c9", "value": "4dadfe0d60ca295ca0a3865cccf3d47c09ffbd05f2e2d76a578e8d645ab72f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7feef7-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324642, "uuid": "326e15dc-255a-4b2e-9d9b-ebd90df72aa7", "comment": "Malware payload", "value": "57c668337fa364b2362915eb6eb6b1ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324642, "uuid": "998154d6-869b-4298-846b-c6b42057740e", "comment": "Malware payload", "value": "4eac4154ff880410fa6ef526c82edeef040ba804d8d9906b6d876cf696ab2af6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324642, "uuid": "59f81640-2ace-4414-aa3d-340d355d9087", "comment": "Malware payload", "value": "cb32b3776f8e6d05e9de898cf143ff602608247d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324642, "uuid": "f5e167c4-e85c-400e-83a9-24110fdc54f0", "comment": "Malware payload", "value": "f1dbaaa994b489883af6c98871802b51d4482ebf439402be95fbeacd8db6a456991e397dd2af5fd909e53083289c4bd5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324642, "uuid": "23768906-1979-42bf-8bb9-ff3a4eb16cb6", "value": "T15F21A8513190E3D0C81CA2367C469C0953AA197D960E14279E5F019A3EBFEB953118EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324642, "uuid": "fcdbd2f1-6212-41d0-8a35-acb3918638ab", "value": "24:9ubibz2D3N9lqLPalrwZYv/9UCk7CNmkK3pC4P/OINo9fIr2UUINwVeC0:93XSlqLipqY39UDOTK3pdZoG28G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324642, "uuid": "4b297260-1ed3-4248-b42d-955e70d55b7b", "value": 1384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324642, "uuid": "b6507357-03e4-4c3e-8d34-14afd7f5dd38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324642, "uuid": "90decb61-b8cc-428a-833d-5fc7c56c29d8", "value": "photov_855714895463.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e96141-8b1a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785308122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308122, "uuid": "8b35fb38-7579-44d3-8c39-53d437ae3b96", "comment": "Malware payload", "value": "d59654eb9e08866b0ad1ba77fc504885", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308122, "uuid": "6e5bbb66-e4be-4140-9734-601d7c40625b", "comment": "Malware payload", "value": "4f010dff7246390a67baa640a60408b15eed0110b318d6fc27d2866ec2f46347", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308122, "uuid": "4b833e6d-5d44-49ba-b265-984d5ded0ed5", "comment": "Malware payload", "value": "51096a5b8189c5e8782c59cfa6b0f3d6d026c07f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308122, "uuid": "302af0c0-8462-47c9-909f-b64fcf36ca4c", "comment": "Malware payload", "value": "2d6ffd90ab3b4bafb63947b3b20366b233ea3ba167d3653766f07c451c7fdda64a5f0d765a4ebd98ad1af493312ce597", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308122, "uuid": "4b8563f7-cd23-4b9b-b923-3b57d2cbc23b", "value": "T1BA236D6516857C14AE99C4375C7F2F0CB9AD43E6314492EE7FCA3CF28C4A6AD920871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308122, "uuid": "dae256a1-f862-4ec6-9d84-835a1c74aeb3", "value": "768:L99NyXsZztCP9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:hHusZBcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308122, "uuid": "2922a185-7793-4caa-a6ff-e30f489dafd7", "value": 50043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308122, "uuid": "8f994105-32c1-4ae0-8b75-f877a1c12a15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308122, "uuid": "6066b3ba-00de-4d6b-8e8b-1e1b3bbadc12", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a01a83d-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785333707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333707, "uuid": "3b56ab1c-f34f-43cd-8db0-8f53e1077704", "comment": "Malware payload (Phorpiex)", "value": "06ba9a25b7493b4c4340e7f4a9a74230", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333707, "uuid": "5cf74565-98ee-4f6a-9d6a-ae7c65885954", "comment": "Malware payload (Phorpiex)", "value": "4f55629fddb7c272fe500b6a132fb15341d2f58ca29fb597be19ebdb77e1994d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333707, "uuid": "46bbecef-fbfe-498b-a7d5-a24cd75d7ad5", "comment": "Malware payload (Phorpiex)", "value": "0517b2830a1bb921b4e3d222298c3a7d7836ebd9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333707, "uuid": "b865f20b-bfe8-442a-b023-929d22acb40d", "comment": "Malware payload (Phorpiex)", "value": "66fe723b3095f6a9db3057baed6b281ea8e7b532e6e65eb55a0fbf1cd4ff91b292c6eb7741fe22684d4445e93c1faee6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333707, "uuid": "af11c741-aa38-4dc3-9f99-82eef6d892a6", "value": "T12C724B0FAB414022CBD114B082BA4636997F687513D8ACC7FBF4A9CE4EA46D2F83101F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333707, "uuid": "c7a927af-371f-46b6-8091-bb606c309a52", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333707, "uuid": "5f12be7d-020a-4404-8e6d-edec3a8d443c", "value": "192:jiawPiyXgzhDD7svwV+AlrMDPdgFAh0Z4YXVWKUSiu9zwM+69iFXVGJxTmv8U9cI:Gi3D7secg006u9n+69iOav8U9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333707, "uuid": "40e2b21a-8e44-4384-99d9-a964d9d94397", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333707, "uuid": "4b37c6b5-d602-4ec5-8fdd-d45b3c59ad9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333707, "uuid": "ef4ef5d1-159b-4c58-904e-ad8f8fd5898d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e2c03e-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349947, "uuid": "aeec3059-bbec-4761-b8a0-32aad3aa3734", "comment": "Malware payload (Mirai)", "value": "53c7f9a6a698c62c09dfcd57eb664a80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349947, "uuid": "dab655bb-a804-4556-a679-3db091851b6a", "comment": "Malware payload (Mirai)", "value": "4f91389a0c0f5451d064d0f31cf90aa77b60b1cf937d0b4ed7f1ec5a358179c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349947, "uuid": "d7c99033-f030-4fd5-b087-85429ae44b17", "comment": "Malware payload (Mirai)", "value": "dc5b7cfae6cae9de47cb815f386717ae27fe0291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349947, "uuid": "a5880ccb-5ab8-437e-87a0-60107194c311", "comment": "Malware payload (Mirai)", "value": "562716b74dda3a610a371c3ef84e8f11f8975b2698475a6579956565818fd87c11485b348960c67c35b069cd0d366f9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349947, "uuid": "a5f84158-c9d5-4800-851a-01032c6e1a09", "value": "T127D38DC2B14D7EAEE0D32E7D820607136D0CDA95DC83810190B6FA575EA76E71E36AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349947, "uuid": "661348ae-da61-4969-bf76-4c96f600c917", "value": "3072:5b4ZfWpPrvdk+G5eSEgJNGv/swm0LLjWo9Fh:BBxrdaeSlqv/xm0XT9Fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349947, "uuid": "44ec4bb4-27cc-4914-93bf-abafe81a5bfc", "value": 133544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349947, "uuid": "23981a7f-c3b8-46d0-b5f2-4d4c411d3e1a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349947, "uuid": "4b871530-e37e-4242-89a9-ee48f0eaf454", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3704329e-8b33-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785318750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318750, "uuid": "d2480570-db66-466a-8d44-78712831b95c", "comment": "Malware payload (Efimer)", "value": "fc5062774b187283d0e3edfe421a001a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318750, "uuid": "129f0741-437e-4620-9821-2a4782eb7e56", "comment": "Malware payload (Efimer)", "value": "504d3db673cea7561272630dcdbcb132c470cdb6b4735af762f541f3adf19942", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318750, "uuid": "b3b8f0c2-fe45-4090-8d44-fa685ed5f5e7", "comment": "Malware payload (Efimer)", "value": "4a2bb63c5007379ea2dffb8669743af4cc773844", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785318750, "uuid": "83a14b31-7a06-443d-8cdf-0ffbf7357252", "comment": "Malware payload (Efimer)", "value": "dc90de4e2ca3a17b71998424e225fca56aaace21e609c066ad3bc3ec85426780609fba36985a74280b0f64f707522db0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318750, "uuid": "a01090cd-55af-49f7-a633-6587db3ce4fc", "value": "T1D2E6334CAAF402FDE563903CD5F22967E876F0B55734CADB17A882912D1B2B08C3D75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318750, "uuid": "8926b3dc-8064-4106-80c7-76cb57411743", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318750, "uuid": "27257e98-7559-48ca-bbce-8daedf605553", "value": "393216:u7unA9OfZgfTp15aPrwuv39lXMCHWUjXTcuI3/PGTAI:uD9OfZw1Uk0XMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785318750, "uuid": "2aec1e65-c10a-4890-8d92-c32ab3acbd01", "value": 14299924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785318750, "uuid": "1ec8f113-41aa-479a-aa1d-a1d728093dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785318750, "uuid": "32f3707c-6e80-4e36-8dac-5bd0ad15e621", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bdacff-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350311, "uuid": "c4dc0f67-3a78-434c-b33e-262c0bfa6493", "comment": "Malware payload (Mirai)", "value": "03b46ac7bb169696b2762e70dbdb2c63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350311, "uuid": "17a2a582-3a78-4ac2-a628-09a4ce6b450b", "comment": "Malware payload (Mirai)", "value": "51682f0b692662c08b4db3a62a4c223b98c1621a443d175ce0987d869a36ca5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350311, "uuid": "76617a10-9454-4c9b-b68b-4411d3d64bc5", "comment": "Malware payload (Mirai)", "value": "5d668c0e6bd50a6a6660908bf42ed7ced2dab20b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350311, "uuid": "9742fcc7-8c28-4c7a-827e-ddafa395ac10", "comment": "Malware payload (Mirai)", "value": "c1964bff20d5516f22a476c358b8ac29a627513cda8e26de5755fe0dd5b3fa5637d287fee9d7ce3ff98f52ebd368fec9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350311, "uuid": "d645316e-eae1-4d33-b249-8e883f8ff4b1", "value": "T15D73126DB3211648CC49177C0F9885E0F65F6ACADB87EC0622B2E617EE0F059F1576E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350311, "uuid": "3b3877ef-38d8-4f44-ac9f-b92d7a9de780", "value": "1536:L1mzS44QYlAWIsGSM1mNdwxZxE0LSYCJZ/otUEfsGMBx6yJIecTV1cKx:Zg4QYlmh1mN+zG/otUwsV6yJIecTV19x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350311, "uuid": "645d5fd2-c68f-4354-83bd-f1609dda4047", "value": 76112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350311, "uuid": "0e48b63e-d5ea-40a6-b524-a098f0b40837", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350311, "uuid": "e5461b3c-1ef6-4790-86b0-ce4a6c949177", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a944eb-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333024, "uuid": "659d6dd1-0002-4d22-a536-60f2041ed793", "comment": "Malware payload", "value": "69a62e74c90315ca4e68bb7670bc15ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333024, "uuid": "2b7e26d5-fe9a-44d6-9409-549d269be9c9", "comment": "Malware payload", "value": "5206388541dc7e4059a638d94972ae6f16e4afe8ad7309d2a1d89dbd9323e53e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333024, "uuid": "c3cb46d3-aee0-4be6-a1df-da7914c7555d", "comment": "Malware payload", "value": "b4a65ffac26a532b8b61d9dc167563c98bb7fefa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333024, "uuid": "564fd366-4d3e-40b5-8878-ce7e973b5850", "comment": "Malware payload", "value": "e3e50ce3c6e29de0f5e5eaed4dd0c42e95d09a57208349790543b3eeda9a2f3f91d6453e453db7d21d1ab080e67f9e42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333024, "uuid": "914a98c3-7619-4a40-89cf-0deeaa76c0bf", "value": "T1DE43F166B19FC671E9308176235CE154BFAAA86375430F8B2ADE7AF18E629B10D10347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333024, "uuid": "b21ac681-9765-43bc-8a90-f38352b796ed", "value": "768:cglipDTGb5bxkPmJICisgJA08YuvB0DXMPN5s67G6zrFEs2I8HRbQ0Oy5QY7rDUH:JlACNmm8sQ8zZ0yj2fxbfZrDF7xgiltO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333024, "uuid": "6c9305fd-f6f9-4717-acfc-5dfd1ab6fc6f", "value": 59908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333024, "uuid": "79eb5072-c4c0-44a5-be2e-51fae87d7321", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333024, "uuid": "fa4c725e-aa4b-4abe-b4bf-a441f99078bd", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a77ab60f-8b1a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785308202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308202, "uuid": "27090579-5dd2-43ff-b9f1-2b4111eecfb8", "comment": "Malware payload (Mirai)", "value": "5e53c7934b756537a0979e14e3622be4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308202, "uuid": "ad7b4cc1-ad36-4807-ae9a-c2bf94a078ce", "comment": "Malware payload (Mirai)", "value": "5211f23b3a96318bfdc662d65b0e3214bfd6fe39fc380180d25c91cfaccf91a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308202, "uuid": "0e516206-705b-4baf-b67f-4c742ed874e8", "comment": "Malware payload (Mirai)", "value": "15e6d9b197f490da92eb23f311f4b0c3e7c2119a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308202, "uuid": "7f1bdf5a-1327-4d05-9d18-7d50641e09e0", "comment": "Malware payload (Mirai)", "value": "49f71dc4168cffb88a14ef1a2c16a7044f9a4e572656c17cb512c9fd6589dddfed1a3a8bf95baa40a41edec2dd959b59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308202, "uuid": "3a37821c-2dc1-495a-830f-b340444253b3", "value": "T1DF63C706BF550FFBDC6FCD3749A91B12358CA50622A43B79B534D528B60A24F1AF3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308202, "uuid": "28a210ac-f854-41e2-9062-70703f60ce06", "value": "768:d1qmFvwkuyZb7/MdqjZ5KreGqex2euZz2quUr/MyfXiJExGPqUlhwOXRlrVbyIk:dvwkBUMZwPqM2FlrN/JVGP2OjVWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308202, "uuid": "0abca7bb-7a7b-4da9-9792-4fbd6b6cba3d", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308202, "uuid": "13f1adff-0de4-4ff7-a03a-2fde7a3a6e8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308202, "uuid": "3bf65216-5517-4dd3-af35-51532cc85811", "value": "bot.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a842d623-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307344, "uuid": "93c07664-0101-43d3-8e1f-213d69741b6c", "comment": "Malware payload", "value": "1d68c6081ec15640b35909a6e3526d99", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307344, "uuid": "3fd63f56-bc9f-4d64-810c-35ac1609f5cc", "comment": "Malware payload", "value": "527230f4e689f9db53c27f649c2ea2bb5e43b0e338150c535d9ce897f6b3724a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307344, "uuid": "de256e67-da1c-4366-8ecb-99f21cda65b4", "comment": "Malware payload", "value": "33c5b8fa2129f5fdfad2909056aa370540d0fe93", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307344, "uuid": "2abe63b9-e3c5-4fad-9b1b-08f73b72ecba", "comment": "Malware payload", "value": "d40e8f1f58c185fe9019c18b3d9cc8ec48d6eace0267edb5be1cddd321ad10def5a49ad12f3b460508fd145218ec58f1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307344, "uuid": "c9358d8d-f2d7-4dc0-a160-876198010e8c", "value": "T12302AF8EE2B41AC6C9CF3B1434F5EE884BC105A91AC341FB639469082BD5EC147EC665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307344, "uuid": "02241af4-a2f2-4f4b-9026-3c50c3d360df", "value": "192:bu+GnEVTY05so/UBWc+8GkLQRqEpEZ7GKXAmTfOL+H1SNmwUH:VGE20Oo/UBn+8BLsqE1mAmTfqywxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307344, "uuid": "9fc8ca03-564c-4076-9697-6c42d1db8282", "value": 9013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307344, "uuid": "cb12f6f4-6a9c-49fd-a9f3-f7088d849506", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307344, "uuid": "f77180fa-b4ea-4204-a9cd-f50b4d987f20", "value": "images_20260728_175157.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd4753c-8ae0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785283405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283405, "uuid": "806a328a-4627-451f-92a8-37bf5c7fb433", "comment": "Malware payload (Phorpiex)", "value": "2542513d55514d50c332445af112dab5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283405, "uuid": "063d1404-bce5-47b5-972e-e000a0a1aec8", "comment": "Malware payload (Phorpiex)", "value": "52d4cc210d5031b02c2e06f3978ec2b042e69946995381d4dfc999f57f0f0887", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283405, "uuid": "85c6f8f9-d5d7-4c45-9a14-beb0896ffab7", "comment": "Malware payload (Phorpiex)", "value": "3dae016fe5a9fd62184d3f6d0f0ec4e986532c3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283405, "uuid": "ef72724f-b44c-43bd-83dc-f7dbff8b2128", "comment": "Malware payload (Phorpiex)", "value": "0343336d07aec2c9df785fddb4737249e93fb1756b55db67eefccc1ee5db433a00b18ae0458c219292ce5dbbbd41c902", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283405, "uuid": "dc5709fe-3392-4525-b4a1-f3a5a5a8f643", "value": "T153624C0BA4808035EBF14474927F526648FEACB623C5F9DBF7E0648A4AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283405, "uuid": "58db3ba7-3f83-4586-bea2-1fcbdb5286d6", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283405, "uuid": "15b505fc-eb13-4a39-9584-519d3034e2a3", "value": "192:AWssGnjXgjk8LcRI+IdJDMBIfeF5oIV1BKUSfEzQ0X1d1gJxTmv8U9cth69ik:ARScqpferoFEH7yav8U9ccX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785283405, "uuid": "2c75ed4c-1571-4e1f-8af3-f7fae93223b2", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785283405, "uuid": "82738ca7-9acc-4727-8be4-0f5d430beb90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283405, "uuid": "56bb6278-2fce-42bd-ae2f-0e18e1734a34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9ab35d-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305150, "uuid": "23db8674-8a8e-412a-b3b7-c6b74a3e6d23", "comment": "Malware payload", "value": "152dc09cb99dc46e8fe52d0367eeea80", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305150, "uuid": "7bbf6ee0-9880-451e-b6c3-88940a247758", "comment": "Malware payload", "value": "53e12f606763831de67a2bcf6b6b7fb239b21c526917e4d0e234975c86be4564", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305150, "uuid": "c6424605-3764-4d30-bc87-afcb9bf756b0", "comment": "Malware payload", "value": "7b399c3f96b0f33df2f4e0ed0658585ea5df92a9", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305150, "uuid": "cda8f142-22b5-4f02-86f9-7d990827628c", "comment": "Malware payload", "value": "904c5c78b4c35721e988cb77f3b3c127cb825a8725692843df4d0df65b1c0b02202c1f51427b724431c1dd110aef212e", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305150, "uuid": "cd4cb4bc-17b7-4cc2-a46f-e631e6ec9c58", "value": "T123B57C67F7085D31C58E82359CFE2754A731729A3B0397163819D8ADFCE33C18698B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305150, "uuid": "cfa3ddc4-1722-49c3-a01f-b9bcfc84e977", "value": "24576:WpCBZsSje9eG/fofmfsfOS46P4O+TD8ksKRwmK+V3In30PG5Z:WpqZiN3mMqK6P4O+TQKCr7rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305150, "uuid": "566460cf-e94a-4acd-be80-abf242d892a6", "value": 2421260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305150, "uuid": "4b463777-8c69-4966-aa7d-ac8c293cac3e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305150, "uuid": "7f6e824e-48c8-4f76-b04f-e2064dd64799", "value": "classes (2).dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfc6d95-8ae5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785285367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285367, "uuid": "77b8bb1e-5546-4b28-901a-66845c68d3e3", "comment": "Malware payload (Phorpiex)", "value": "8fcec564fdae661e05b257376d996671", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285367, "uuid": "7cae571c-f4a1-4ab2-b090-ef9581b7f4d7", "comment": "Malware payload (Phorpiex)", "value": "543dcff189a5f2fa7beeb6863e78edd31d74226196687185ad3e655c3ea034de", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285367, "uuid": "5a766852-8b44-4027-876e-f24db4b7d76b", "comment": "Malware payload (Phorpiex)", "value": "ad6ed7c361ebc42a297df23b4a3452ee5b24f2cc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285367, "uuid": "976305d9-ec6f-4a5c-933e-d4e3d1ad2306", "comment": "Malware payload (Phorpiex)", "value": "f72a7a7b04181d1c9a8aefc38f9deb25327b3c2541f5ddba6ca9207da41e4e112752f66cbbc850b0e9824e2138a82bc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285367, "uuid": "3b02f270-5bf6-419e-a5aa-64c629c633eb", "value": "T1DB623C0AB4808035EBE144B4827F526645BDACB623C4F9CBF7E064CA5EB46E1F43616F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285367, "uuid": "95780116-3f11-4e29-87b2-f77d91308808", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285367, "uuid": "2b9e6878-43c9-4b08-aa7a-f8e2166dda17", "value": "192:AWbsGnjXgjk8LMRI+4NJTMVJFeIFFBKUSfEzQ0XFd1gJxTmv8U9cth89ik:AqSMqcUlEHryav8U9cyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785285367, "uuid": "bc46c4df-a154-4d1a-8ebf-44e273bc1015", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785285367, "uuid": "af7789a6-856f-46eb-81eb-3b4441adf535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285367, "uuid": "1b1ce2f6-45f3-4762-85e9-3c03abc284b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab589401-8b7e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785351158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351158, "uuid": "42186cb2-144a-4263-b225-205eadd4a595", "comment": "Malware payload (RemusStealer)", "value": "69705cd49851f98f1db3d2598c62bad4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351158, "uuid": "cc1c4917-6ab2-4a50-97b6-807584b15236", "comment": "Malware payload (RemusStealer)", "value": "5459c708a6b6a6bfbbc7e28b668fcbb1a18138abb758244fa15d74d3216dfa3a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351158, "uuid": "59b9ebe9-0d54-4072-8251-1b0218cc4457", "comment": "Malware payload (RemusStealer)", "value": "0ff48c1748ff0a6656cfe14342e985d77bc0f457", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351158, "uuid": "2d5ed498-cf70-4401-a4de-0e4dc9e4b43e", "comment": "Malware payload (RemusStealer)", "value": "bba92b38c975da9a646f6076530aeb724fed2a9a45aaf96cbbc361b2fe30ed489101cdc2e6618d114544edabd2220b34", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351158, "uuid": "b5fc4d46-d95b-4d6e-abb9-79074e1be9f7", "value": "T139C55B0B7CA048E5C4AEA33189B752517B71BC084B3573D72EA0BA792F727D09D36B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351158, "uuid": "451132c3-4e52-4866-b593-9f711d58ab21", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351158, "uuid": "e2ee4e08-1476-42b9-86dc-4277a23c8a32", "value": "24576:sGQPA3sBP6kSI48a3DyUMHyRRUZrPgQI1C71wWGXIoTgz7s27lfzBele5rKDm7ja:sGQY3sQkSmaTZMHyMBPDcCGN0Hv7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351158, "uuid": "e3149829-6d23-4ef5-a747-ff042e88c789", "value": 2511720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351158, "uuid": "c0fe4671-9c64-42ce-90c6-8b9636a4f9c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351158, "uuid": "d5d6c5cb-5e33-4972-9ff3-aeaeaf2bee58", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc8cfe2-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305177, "uuid": "3047d85e-afd8-4cda-b22c-6fb5b95a9489", "comment": "Malware payload (Copybara)", "value": "aa266547b4b3d6df74492c8f145903f6", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305177, "uuid": "31fb05a4-8410-4e7d-bae0-c1339b703802", "comment": "Malware payload (Copybara)", "value": "54f14272fc6bad75f0b83984f701fce73fa73f0d9de209c161094f27836cea9b", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305177, "uuid": "4380d39b-41a2-452c-bea3-78d95bbbe905", "comment": "Malware payload (Copybara)", "value": "1e32f602fa705b5f4df7775be28f1dd9d535e249", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305177, "uuid": "9fefaa0b-701b-43b9-a5c1-fb21ba15b055", "comment": "Malware payload (Copybara)", "value": "2aa3ff2933e38279fb134851c4dba08d7e97bee306e35950d1020d8bb7c2d84c409bf1f4a443065f16a99f63b258c03e", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305177, "uuid": "09a9f091-f01d-4241-8710-5e11cdd8e5c5", "value": "T10DB63365B3468B1AECB38F71AC20E766017E6D0D9FC302A75942B77C18BE4C44B56EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305177, "uuid": "44913e84-dc7a-41b5-bb83-ceeab83d9f7b", "value": "196608:puq1wWwPLCLH+QN4ut1eMSst4uE+Fm/IyBwybBpxjMjdHS2WKASDL5phdfRF:/1xwPmLH+luHeFVpImgyBwydpuSNS35t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305177, "uuid": "1d13ae6d-258f-49fa-8eb4-95b223b485ef", "value": 10578489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305177, "uuid": "f60a2bb6-055d-4e03-8a33-6657f1b4d614", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305177, "uuid": "4e41fdc0-3051-4698-b5b5-b129ef3d8aeb", "value": "54f14272fc6bad75f0b83984f701fce73fa73f0d9de209c161094f27836cea9b.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d20d21-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (ReverseSSH)", "timestamp": 1785333170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333170, "uuid": "f7f3bb7c-9253-4b62-8deb-83a25d3aed0c", "comment": "Malware payload (ReverseSSH)", "value": "b9ebfafaf78adaa95eddcd326aa21a9b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333170, "uuid": "95dd8811-66ef-4540-b2d5-97f818ba4f7e", "comment": "Malware payload (ReverseSSH)", "value": "559e5ff2b8afb25bbc62275355ba2ceb668e8707de6b221315afb6c2390ba68e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333170, "uuid": "d4c3a7ee-c6f6-457e-8d4c-2e695a5820df", "comment": "Malware payload (ReverseSSH)", "value": "515df903fd5b5dfc03233ee56978adbacf8466c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333170, "uuid": "96928842-7ae1-45b6-9315-8ac41dd722ff", "comment": "Malware payload (ReverseSSH)", "value": "62c8a5208c7ed86b10e60a83b1ff767b974bc5fb9b51e428a8681ae78aa08d35a1f3730cb1c5438e1e0bdd12e495b87f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "ReverseSSH", "colour": "#C090CA", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333170, "uuid": "96e8c3d5-530b-4653-ac97-a7e929e0d70a", "value": "T1106533AA8191FEFA9D175831F6F29AE502965FA1ECF03C891CD06B42DA7DFC271016C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333170, "uuid": "f5c07685-f770-4645-9bb3-934c60105f41", "value": "24576:1fzIvgxm+JS4zZz5Zs8ZpXE/xWKE6IWGeeyBBCk30K2K7Z3qEMIe:BIoY+J9ZbA/UPWdBQkkK1d35te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333170, "uuid": "98a3bf1a-fbd5-4212-9bef-eb341274b324", "value": 1501896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333170, "uuid": "504d9299-2018-4a70-9283-2e26a45feb8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333170, "uuid": "8769cca7-250c-4986-8460-2bd6bcbde159", "value": "upx_reverse-sshx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f518ad70-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307473, "uuid": "aacb66d8-71a1-4b49-a3c5-1a0de7d88a6d", "comment": "Malware payload", "value": "1f37bef5323dfa52e3f5ddc9fb6400ed", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307473, "uuid": "f0977a7d-c70c-4894-8df7-7f233f055d37", "comment": "Malware payload", "value": "559f371c949ff379c0f442fa7e3e35a3fc05ee03890eff90700f44db8a0b7348", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307473, "uuid": "9f244e28-8d03-407c-863a-5d353494d794", "comment": "Malware payload", "value": "efd17361c9a4f0ded9612f1cae3fdd4b501ede34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307473, "uuid": "97d17f41-3163-461f-a2b7-0587216252bf", "comment": "Malware payload", "value": "8243e99eb2254ce7a66fa3e517229182a9b3b5fff62f7535905584f52a60382f0eb899995519e6f6a08e66b2fc2f250e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307473, "uuid": "78570450-6951-40f4-bb07-63caeb382ba5", "value": "T14E21B399D5B474A7CAD0F9BB38E33BE68106A3D2F946AC16B0BF4818212EA44012618C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307473, "uuid": "b96c76bb-419e-4e68-b7d3-b0b322e4617b", "value": "24:9giifsRYiw4mTNRtl1hdn81qAL5hCsSl6T9mdtYI7tSTBreZbwvQdfZWChiRbBtx:9Biff7TrCqM5AsVTR+tSWwyhW9lfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307473, "uuid": "30384d58-8145-4084-9d85-434f074fe609", "value": 1407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307473, "uuid": "34868686-9807-4fbe-b415-0d75f4c45456", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307473, "uuid": "a888d640-bc49-4f74-9e94-8b61e700c370", "value": "images_20260729_060808.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed88c4b-8b5b-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785336265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336265, "uuid": "92807266-bcf1-459f-b381-e20e020814d2", "comment": "Malware payload (VIPKeylogger)", "value": "6f5e1edf2f796de76e610ce91889e2dd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336265, "uuid": "53affd21-231e-4250-bee1-4f40636269b1", "comment": "Malware payload (VIPKeylogger)", "value": "55e5e366d83ecefc831cac6499bc4f3c1f81fca0ad3c14db484eb59d53360d7a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336265, "uuid": "19c704b3-255b-4c4c-9b0d-ee6d9b739ae4", "comment": "Malware payload (VIPKeylogger)", "value": "1471073da38ee5a334b357e756594f8aa6dcaf30", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336265, "uuid": "665b20a6-81d6-45c0-bd08-ce6e3ef1872c", "comment": "Malware payload (VIPKeylogger)", "value": "bc2be75a799d6a1fa18d1f8216355f1673e2b3b07d19b99937b6c0c1ecee63d8bb8bb9b3bcda38bc593e24120e430ad6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336265, "uuid": "8d2478e2-403d-4481-9a90-873cbfe4de15", "value": "T11467D75AD31BE6645583737A27D5A127E8C805CC6B9483A0C5DACF1E77CAE8908D33B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336265, "uuid": "9a3dddc9-d0cb-4fd5-b36c-382a9cbc73e5", "value": "768:q66ImawxDoj+DSAh9oeWpBacSg0B+qsUcyI2taup1ZL8dronuQYhFVL/fBj45tGc:cZpOQbw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336265, "uuid": "fd57112d-dd8f-4941-bd94-c3f07f29c362", "value": 30491534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336265, "uuid": "4e7a86e7-c864-41b2-8c2c-191f167965ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336265, "uuid": "1dcdcf63-31ed-4666-8d9f-e6221a6aa494", "value": "29-08-2026 -T\u00dcB\u0130TAK-SAGE-TEKL\u0130F \u0130STE\u011e\u0130 PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54e015-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351641, "uuid": "445a0884-e382-4d03-9c9f-3bb7b17cbdf1", "comment": "Malware payload (Mirai)", "value": "745a6218be6d138e39229203fadb6393", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351641, "uuid": "66b8eec7-de38-46a3-9fdb-a1f001f30478", "comment": "Malware payload (Mirai)", "value": "5601862241d0a31a19c5b9a9fb3e9a7749aad3c6c0b481e4b8ccf0734d96c4be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351641, "uuid": "7d2a08c2-1f1e-4797-a35e-dcc7d077939c", "comment": "Malware payload (Mirai)", "value": "218cb3adfddbc7da0ddfe99677d42eb1bdf39a79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351641, "uuid": "d425c627-8a05-45b7-bc41-919a1b180469", "comment": "Malware payload (Mirai)", "value": "16d1af0e4c36835655b05d52eb03db09dba77d53e2ceacdea8a41008008eacb85434e801889e4c0f7d28fa2e430e46cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351641, "uuid": "06b21b66-6109-4138-b19e-7f8a0d493d83", "value": "T132635C1661356913C0E1E6FA01B7C762B2961BD923C8D2CFBE630D1FAE363006966DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351641, "uuid": "9f0890d4-9a17-4be4-b1dc-492b6cc3a7d6", "value": "1536:blBp4I9ep1h4Dg7jIOvd0Aw8MClR6JfiV09bdUJm:b7p+hPPVR64k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351641, "uuid": "33a1187f-4d43-4ebd-a740-2f920a855c38", "value": 69368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351641, "uuid": "3b60b2db-0fa7-4f43-ab43-55d88915d67d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351641, "uuid": "c66811a1-6c73-4141-9847-18c3a8e35f34", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7796bb-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324422, "uuid": "8f796737-150e-4db2-9c52-8b25d587317d", "comment": "Malware payload", "value": "9376a6ddc73c70070dbec59aabd64e06", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324422, "uuid": "cc96954a-4ab4-468a-b95b-e9991a624ee6", "comment": "Malware payload", "value": "5641d81e246be2bf92a7e039c5df2048e3e718758be982254b19101b6edd2c72", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324422, "uuid": "329ff5c3-6c5d-4213-92bc-2d2295e88e4a", "comment": "Malware payload", "value": "508100e47531bfbfe07d7a616027d21180068abc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324422, "uuid": "b9284ff7-6825-4ae8-84e9-9a39332a6c28", "comment": "Malware payload", "value": "6c36b72a69307490d729524e00e0f3a6fc31495b1cde98ccab611ac09ffba26ad53f47690ab1decd03266d237ab0dd34", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324422, "uuid": "69d0a74b-576d-49de-a4b0-58bd02e80a64", "value": "T17821B774E129C003D25F36FE7DE794BD292B92B33D08E988B2B9908C3C055CC0B1E045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324422, "uuid": "45c17a1a-5339-42e5-a35f-8da5f507346a", "value": "24:94RZxakVO+fazOJjiBEX2Y5PWpfKOuo7VZmkkZzv/5cpeY/oMHaR9udVTN:9YakVOtKgwhkSOuo7PT0tcpeYwGxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324422, "uuid": "0a01e304-e729-413c-a32a-fd08834f8a57", "value": 1320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324422, "uuid": "1ff85e96-8c5b-4515-b01d-9242b077b78d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324422, "uuid": "051743cb-764a-4615-9af4-b41c8a6da340", "value": "photov_948493507827.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11c4214-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307359, "uuid": "70d4b708-37c4-4da4-a9f4-fbf87409475f", "comment": "Malware payload", "value": "48b63ba27de4ba5b2a6f73d96ec5390f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307359, "uuid": "2f78c218-3880-4c80-8ff5-54b8466c6e98", "comment": "Malware payload", "value": "5702aada0b5f22642cc53816d5a4062dc77f4f10cfe66ad433b13eb0cc21a22e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307359, "uuid": "c06d8016-be2b-4ae2-bb04-7128abe32e55", "comment": "Malware payload", "value": "39a51729ad6b2a1487a03c994b8a9b0dc09634cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307359, "uuid": "a2f83f90-1e17-4f94-8814-8c15dc27a68f", "comment": "Malware payload", "value": "493013d9b60e34c7d5bebc9ccebc4da3f39086c15222e95d5362c5126ff62ae2dc51d1c6ee4369f9d7932890b87889fb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307359, "uuid": "c32983aa-e0a2-44af-8ce3-54d460dcef14", "value": "T149029E6048A8A673C6D22E32F02B941F657518C3DB09F64B36CB47FD087745517B8922", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307359, "uuid": "e028bdc7-e3e0-4192-a1ea-46c622fd079f", "value": "192:xr2m+bx7mJ5ySeCKcjRlOs231S1HrIwxwt3dJCX0lt:xqm+17mJ8SeCbdlR1cwx63J7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307359, "uuid": "a169d2df-5e33-455b-9600-6d38208e92e1", "value": 8470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307359, "uuid": "9bc7fe49-2249-4501-948b-952266eb2bfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307359, "uuid": "4d9e4d5d-beed-45de-9cec-74a0cedae8ed", "value": "images_20260728_142128.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b206def8-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785350310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350310, "uuid": "d0ad9a10-7379-4260-ab0e-37c310f72cb9", "comment": "Malware payload", "value": "d0809296612a2b5428fdce19f8507b3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350310, "uuid": "7127ea3d-b626-4dcf-b131-0fda8bf1dc1f", "comment": "Malware payload", "value": "571e00f38e991099c5544fac98d45e5e3a89bebc610beb5512cdca01d56d13d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350310, "uuid": "bb006d3a-aae8-418a-818b-1b419f903a87", "comment": "Malware payload", "value": "9b502dd0bb20cdfd306bc764e404a66ca6b5aff3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350310, "uuid": "1d8aadb1-7fee-4891-8db7-11ef7d8f2c16", "comment": "Malware payload", "value": "0247f72ff1546bfb73cffb8d3ef73993abb0a0e0d3d349dc99310c588d6359ed2959823f0e1ed31a618a51c3d68b7242", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350310, "uuid": "73e014fc-ffa6-4921-8ed9-a54735c00038", "value": "T1B4234B62C5BA9D02CEE06A7A03F343E3C2DA8B544394CA4FED952EB9CF477108C5665C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350310, "uuid": "bcb8ba5c-1f28-4faf-9d8d-ada1a6278e75", "value": "768:iCTu4r9HH4nnnHfWVGPAkr9HH4nnnZI9RX2ESVsM5ik+qS4y1PkZ9jiBeTMinfMg:VTu4r9n4nHfWA3r9n4nC912HH5zS4X/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350310, "uuid": "1cd43fc9-1d55-4156-9c12-4ea33dcefc4f", "value": 47320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350310, "uuid": "513ef828-ea2a-480c-8639-6692bc1c50f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350310, "uuid": "74978ffd-4082-4f02-bed7-423d6a2640f0", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c7d035-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324629, "uuid": "16362861-ee29-480d-afcd-dc2919e6bd18", "comment": "Malware payload", "value": "194bea0f4e6e187bc765a4a427b22e07", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324629, "uuid": "8317dbbe-c630-4269-8e15-d8b6e2a69b7b", "comment": "Malware payload", "value": "57a855d9f0af4f98e71bfeeafe729631b13be2b8fea657b5e38341a980efdb9f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324629, "uuid": "bed49a99-4a95-41fb-af17-5f200e5489a2", "comment": "Malware payload", "value": "267931c2ad6602107c60e6b73b62f2f0bda89f19", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324629, "uuid": "3e15874b-0f61-4969-beba-4b537161b714", "comment": "Malware payload", "value": "8aa5b2d853b38e0659d4acb4c17ff04061d3c8d26624cf36ce95ff4cc89ce315aa191ab46ef2d7b6bc0bbd346282249b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324629, "uuid": "7476815b-6816-443f-8e02-c4125cf526d5", "value": "T1EF21954CC76D9A53DB2796B7BC450D4A18284A3380969AB22D6261D21FA714B963CCA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324629, "uuid": "31da47b4-4da3-45c6-a43c-1bbdf89ccd50", "value": "24:98QtJ+9eED3IV14Siuq82H99Se19H0Hlwcmkis+UaNuUamqXzp4FQVbwKh:91tJMTo14Sid82dse1J0HHTis+UkOVzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324629, "uuid": "2b940e12-908c-40a6-9a89-b61c0fad4660", "value": 1281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324629, "uuid": "88aa505e-d1c0-43f8-89f8-77639694a11d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324629, "uuid": "44d1e706-798e-4b39-877b-d2eceb326719", "value": "photov_482676409233.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3c1944-8b2a-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785315164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315164, "uuid": "a61d9b5b-d825-40a8-b0c3-a30178b924db", "comment": "Malware payload (LummaStealer)", "value": "d9bf6b87aa152770f1ea8a25199a6fca", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315164, "uuid": "49f5be15-aaac-4f8d-a983-0bdc488038fe", "comment": "Malware payload (LummaStealer)", "value": "586b43c58f513ae9a476bf9d6e1614d616e80edc539279a03975fc68a81a496e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315164, "uuid": "214e99b7-15d9-4d15-9b9d-625f2d605a66", "comment": "Malware payload (LummaStealer)", "value": "f4dfb41e28e651dd305fbb85e34396abbd226b9c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315164, "uuid": "56dd513b-45a5-4ed3-9b68-77a038de8a1c", "comment": "Malware payload (LummaStealer)", "value": "46097afb7ef0e45a3281443f57240e7b834c5b6d9b7593034b051c88b5209edc53f742b82a53a5f1b9623484bc2ee9f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315164, "uuid": "633bc781-a756-4c2d-97ea-e02afc3d54b3", "value": "T1D1D54A11FCD795B6E403263294E763AF2738A9055F35DB87EB407A79EE372D20932209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315164, "uuid": "952f6db2-dfd3-4bd4-9d79-6b4dff2b5e7c", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315164, "uuid": "047b9522-1cb1-421a-8f1b-fb22f128b771", "value": "24576:qS+wUIQcC4ug/LA+IEVDGFb95PxZdjToUY7I8vfzu2E70th4crt0Q4UnNB7vxiCe:hLUE86hGFJqHhbDnvMEbQpj3ZT4c1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785315164, "uuid": "1a59476f-e665-453d-8a9a-536dc5c48017", "value": 2920800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785315164, "uuid": "89bfa246-583d-400f-8cda-5663f7043b83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315164, "uuid": "8b961a30-7bb3-4d60-8ab5-569b4fdc1e20", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871a70c9-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307288, "uuid": "b0dc7062-6da8-4197-971f-e1283a71bb4a", "comment": "Malware payload", "value": "63d75817b0808e7938896863435bf957", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307288, "uuid": "cdd4cbd2-a2ca-4b6f-879a-de2f1331cc94", "comment": "Malware payload", "value": "59454824c45375a02f81004a05bb5bd3b174ca3e9c3b6076e321782afa615d8f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307288, "uuid": "426ea364-f9a8-4093-8e8e-a7a18f9f2118", "comment": "Malware payload", "value": "787992d7d6bf41f424689a3806d0edc6adb3cf8f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307288, "uuid": "13109481-b257-440d-a161-8f16f38f6fe3", "comment": "Malware payload", "value": "2ca03b35523cbc804db290ed87fa360d6eed3411896f93cb5c8b6193bbb12b1177db56da494b6590b3fc29cd6c85c312", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307288, "uuid": "21869e6e-db8d-42f9-b849-16bfb079c36b", "value": "T15852D17DA259C713E9FE45B526F88AE30D0ADF4CE181871E2EEC37FC9451D970658088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307288, "uuid": "bfb40e4c-55a2-45e5-8d55-bf26dbf9dfbc", "value": "384:7KmNKO2anSMrQUBsqtMEyi6hDrHK/ZuqK:7KG2an2qNa+RFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307288, "uuid": "8fe5af7e-70e9-4c2a-85f9-cc45efccf828", "value": 14515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307288, "uuid": "2152afaf-5058-4c99-a172-f3b1d056eca8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307288, "uuid": "07c9ea4c-76db-4c29-a0c5-2397cc9f317a", "value": "images_20260728_155150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59f6945-8b1b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785308628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308628, "uuid": "c43e45fc-1f0c-4db7-8e7a-cc31ffb0c82a", "comment": "Malware payload", "value": "e7c202b28494b110cbba1e6dbd9263b7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308628, "uuid": "e0790a48-5ff2-45a0-80b0-a62e81077f20", "comment": "Malware payload", "value": "594683e84aee02d2b6e0866bb55f8c665909cd96501a581d86be52126e63495f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308628, "uuid": "0cd93fed-83d6-439e-8d18-661354fab797", "comment": "Malware payload", "value": "955468369691fad97e6c682676b689977d171825", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308628, "uuid": "dcf48de7-44aa-4a25-b697-7e4a35cf1f6c", "comment": "Malware payload", "value": "c24a4d61f065847d7326b90956918de7bb8812bdb379ebb2f5408672ce548fabe7cce3e4bbc6d09ab0e4b6ba6ee12cd5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308628, "uuid": "ff4ef7f6-7b14-4ae3-8062-2ff3733ff9aa", "value": "T12D43B69167F9151AF6F38E783C7465968C7BBE726D61E08E8280204F0875B95CE78B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308628, "uuid": "d438a7dc-d0ee-4905-8c93-eae2dcca3bdb", "value": "83fa772670ac674cd68ff73f3ef04802", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308628, "uuid": "24c5a3ac-c85a-4fee-ba45-3f3e5b367364", "value": "768:3pM+/0vaXDiTLlGCI0App3vWSph6koM3R+qsq:5CEiTLXA3/fp4koUR+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308628, "uuid": "ae1fcf7b-d699-442b-aaf6-e473e13ea857", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308628, "uuid": "9abd5ecc-df0f-49b0-8c44-38064fbe772e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308628, "uuid": "dab82649-d758-4a7f-964d-53cfa28eb64a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3985824-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349856, "uuid": "aebd70f2-cf87-4fc0-9902-779737920580", "comment": "Malware payload (Mirai)", "value": "97d218f9e6526d9b45e8f8161b185ceb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349856, "uuid": "5114af10-ece1-42f8-a65d-645c53142e31", "comment": "Malware payload (Mirai)", "value": "5a38ada8c168bf7f2e88f353ea58a64033f89b3170dcd016ccfba708e64ac0fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349856, "uuid": "f1bf460d-cc44-4ec3-b439-ee6d45d62ec0", "comment": "Malware payload (Mirai)", "value": "00008194c678e5729736025b7b678cd4d0c256b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349856, "uuid": "d9ea4c3a-10ca-4f9a-bbf8-6caec27b3186", "comment": "Malware payload (Mirai)", "value": "dc464ad882ea230cd005bb2f30019df11d25da512676c42d3f49a9d0585e0b7423626816dd6eb10cfb3bab742252b92c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349856, "uuid": "6b685440-253e-4dad-aac7-04f5f4d90130", "value": "T123D31845F8419F57CAC255BBFF4E438C7B2A1768D3EE720399256F20378B85A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349856, "uuid": "143d50a7-2b97-4948-bb40-114e8f8a5f7b", "value": "3072:OZ82ltN093nKs4uVwx9a2uPO7Y2KnffN0b:OazXv4uVwLa2eO02CHN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349856, "uuid": "74be60a9-f11d-4c08-a45b-6a2523ddbf2f", "value": 140664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349856, "uuid": "12b011c1-2d3d-430b-b052-e09b3e27ade9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349856, "uuid": "90a12f88-f8c6-4e20-8549-f3ff0fa7f45d", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220413fb-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321292, "uuid": "d14f5e98-fcfd-4f4e-a163-91a11c8cf9d3", "comment": "Malware payload (Stealc)", "value": "2ed643192e51d9478a1f312dcf54f703", "object_relation": "md5", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321292, "uuid": "bf617124-1dac-4faf-b5d8-9efe52009a31", "comment": "Malware payload (Stealc)", "value": "5a5c24218a370368835995078715b51163521fb06d17922876968d0f2ec2b9ae", "object_relation": "sha256", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321292, "uuid": "0b40e08f-4187-4e0e-9fef-52d3da2c0e9e", "comment": "Malware payload (Stealc)", "value": "0ab7244a24e7ec4e84e4af940c42894a362c0782", "object_relation": "sha1", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321292, "uuid": "bb4a4669-7ff3-4436-85b7-4b6950970f9f", "comment": "Malware payload (Stealc)", "value": "50a6ebcad10d5de6d7a7b5a7c6a5e53027584299729535f17d0cf3a4355e93fb08d654826ad0e0404b85e20bc8e1c48b", "object_relation": "sha3-384", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321292, "uuid": "d07e24c4-1e1b-42f1-97e5-52f67c9f6e40", "value": "T1D53160614143E69ECFCE92FBB8227F08763E6F4362D42200E715CEA1DC0812D686B2E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321292, "uuid": "967a758c-a52f-439b-a324-14eeaac4df2a", "value": "48:P8e68FTq1Be16Ie2q6u285E1e5tDzGnVCAzS25+PkQ:PRFgBg6IO6uae59zGnSE+PB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321292, "uuid": "7b76e5e4-ccfa-4ba0-923f-64ed466070b1", "value": 1852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321292, "uuid": "0851259c-5d50-4bda-861c-e7f9d246a547", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321292, "uuid": "773fa72a-ccd7-4964-9d93-5e54c95d8514", "value": "sleestak_payload_1 (2).ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c10e80b-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785352608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352608, "uuid": "0bfdb954-f0e5-401e-b4b1-e67b52d811e7", "comment": "Malware payload", "value": "16d0dfb8e6a93f5b3b409ff2c79f57a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352608, "uuid": "98c91c28-dcd9-4cb8-9123-d9b0206fa5a2", "comment": "Malware payload", "value": "5a6a5d0a5fa64dd08476f2e9ed9dfacd92b4a142777fee5d37b5c05fbb972c2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352608, "uuid": "fc0bc492-4d80-46a5-a8a1-f5d75e8022bf", "comment": "Malware payload", "value": "dc6997c1785236b7711bfa11856b8fb6aefaf5a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352608, "uuid": "0918255c-be43-45e7-9f42-b6296a273b6e", "comment": "Malware payload", "value": "64913647fd1288590c5bde9c7fc01a7a7e9b2323491068c0a8966e452c040fae6bc0ef5a415453c7930ebe258cb33015", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352608, "uuid": "a856a49c-19bb-47db-8696-b68582e89785", "value": "T1B1C35A73CC352F58C664E5B5B0B08F7A6B53A824814B5FBA5877C2788083D8DF6467B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352608, "uuid": "a3c3e433-98f3-49b3-8326-bf9645791dd8", "value": "3072:bMv475R9k360PCKScU2FOdWEWKJggtlog:bN75R9kq0KLboEWKVX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352608, "uuid": "7fa72141-f019-4884-8390-27b148c76315", "value": 124568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352608, "uuid": "e1cf7e62-0d33-4349-a82b-a55ca0b885f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352608, "uuid": "ba6e2e59-5c2a-4275-bab9-321b91289caa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a8ff391-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323883, "uuid": "62e343b6-d411-47c6-a51e-564356831c93", "comment": "Malware payload (Mirai)", "value": "879214f1e27c85da0908a64f490ee5d2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323883, "uuid": "db9f867b-bf99-472d-b553-c42120a64300", "comment": "Malware payload (Mirai)", "value": "5ac2f143982ab47b9f97f33498bdb76a2305e7f71f9592ba7250df5f861e8663", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323883, "uuid": "aba395ea-868c-46ca-a3f8-12af30a0f727", "comment": "Malware payload (Mirai)", "value": "3fd53b4bae78834c963573be13d9bbd969b8079c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323883, "uuid": "7d8601a8-e602-4158-9b3d-e4e1b5ca02b9", "comment": "Malware payload (Mirai)", "value": "201b9eba7c40ecba9dd0802c57524d98cf7bc178f0e56edb51a78448dd4a4ce83897f2ef38f4aed563563a958179b913", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323883, "uuid": "8ad666ea-ead6-4d08-87a1-73e315ba105a", "value": "T14B31FCCA2B431AD93B2C6F22B9498B1C53494DDDE9167BC8B5CBC8715DC06D2BC08A67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323883, "uuid": "d272d181-7c1f-4681-8c88-9907f7c92a2e", "value": "12:bA+pI6nRE+pIENNIlvHBA+pItEK3H+pIRe+pIVHeq+pI2N6Zq+pIh+pIrKA+pIeP:XjdNI7BKCI9xbeXXDW9+Pxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323883, "uuid": "144427df-d37a-4cdb-bef5-7a86394c7cf5", "value": 1760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323883, "uuid": "f187a147-0400-422c-a392-c020c1ad8b51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323883, "uuid": "f2e13951-2b5d-41c3-8d7d-d5620b746ff2", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "377a2432-8b78-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785348386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785348386, "uuid": "d7cfc0ce-2c40-4773-8aff-49984a9f89f4", "comment": "Malware payload (Mirai)", "value": "3996a340f523c7d2b0485540e9f83513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785348386, "uuid": "24998eb6-8158-4162-9e6d-cd419eeb9e34", "comment": "Malware payload (Mirai)", "value": "5b1a4ff601b9a7eb49bce8aa570a31cec226313842628ecc204f24ff7ad280ac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785348386, "uuid": "d36c1f8a-3c96-4635-9d9c-6c74618de045", "comment": "Malware payload (Mirai)", "value": "599b0c75107f3e6c3d9bd9b1d73ce35afe34f695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785348386, "uuid": "6cd0f5a0-908b-47e9-8301-5af3f8414703", "comment": "Malware payload (Mirai)", "value": "05b7895f1ca024216c67ed60d0eff2b695e0736068fd9a92119d7d5a300ed05865e843bbf524fdfbfdbac59c4952ad1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785348386, "uuid": "ce902e32-b924-42df-bd5b-ba4cf153cdaf", "value": "T107044B4AE6814A17C0D717B5B6AF4245333297A5A3DB33069D14AFF83F8765E0F23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785348386, "uuid": "abea41e5-c0d1-417e-97ae-b0520627e307", "value": "3072:KYzkn93AnNwTyADd0P1Qdga6bj9++Ro8mRqUZWVkvGnoYkM/97U1//Omqwl/KUR:Jzkn93ANYygwydga6bj9++DmXWevGnov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785348386, "uuid": "e1a98dbb-888a-4395-8b4e-3277a957426a", "value": 189072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785348386, "uuid": "d2be1c60-0bde-4b19-ac95-20879587775e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785348386, "uuid": "aac150b7-dc56-4f3f-aadf-0fbaed19468b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806cd4b7-8b16-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785306418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306418, "uuid": "fd40e259-a789-4ca5-82a7-48b218e444c7", "comment": "Malware payload", "value": "abc8d9e8b098f5637d8b8ce07f84a0bf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306418, "uuid": "1045ac97-3afa-45d6-b8df-85e250f41bb4", "comment": "Malware payload", "value": "5bd481c8418054abd52caa72de1ee3f8d68db5894405819858271991e5efa0e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306418, "uuid": "30ca44a0-5406-41cf-99fb-2b2250dc6607", "comment": "Malware payload", "value": "c843179cb9a2b5dd3f5abb3194e6688ba8787b67", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306418, "uuid": "cf2a4cbd-4d3b-4662-9fd7-b57a51538eb8", "comment": "Malware payload", "value": "ef213b3717f13bd84af80ccc8456f15380604d21ee6475b88c429f65de760ddc737b299a511af9b0933533619e554b5f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306418, "uuid": "6cb5992c-09ce-4598-b552-6e73975fe644", "value": "T1FAC27D966A867C44BEC94A3E4CBE2B4D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306418, "uuid": "85516efd-b7bf-4beb-b0bc-e41cc77d51a7", "value": "768:h8vCB+25j6es8RX9FYpMSUpi+20qUpi+20YQX:h8l25Jxd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306418, "uuid": "1df5143f-f744-4f84-8cf2-64073c3aca96", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306418, "uuid": "a179a38a-a376-4362-b848-a184a6fe3a82", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306418, "uuid": "11e247a1-ec91-477c-9d19-53467d2f4845", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c890e4-8b92-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785359649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359649, "uuid": "bb3db6d4-69a0-4116-9c41-7b9b3176aecb", "comment": "Malware payload", "value": "3cae1190a9fea6022ed6c2bfa39cbd0f", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359649, "uuid": "df159a13-5def-4c75-9fd6-620b45db8697", "comment": "Malware payload", "value": "5bee3cf919dc5bb90de4be716a5e035b05803c1618795382546a735629c79e2e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359649, "uuid": "fbd84065-165a-467f-98ee-212e653e2ac9", "comment": "Malware payload", "value": "40d2fd45ad590390321bbead1ef8b89e23477e07", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359649, "uuid": "8756615f-9be1-401b-a8c7-7dcc2b5eb570", "comment": "Malware payload", "value": "09896a4a8f3e4078ec931ad1639a3b5d9dd780eb0e07254f81d47dd1f2b6a832edfc70deec4476a0b11f9a8fc036d92a", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359649, "uuid": "e7ce58bd-28bd-4ed8-887f-8f5d86f17ce4", "value": "T1BD25025AB1B580F5E16BC079CFD2925BE3B27445472093DF16A087BA1F177E0BD2A322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359649, "uuid": "b7c5c3c6-64e5-4369-ac6d-be3baee9481c", "value": "08fd62a9d05cc8111782017958ea975d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359649, "uuid": "9cd5a011-cec2-46e5-abdd-0f2df16ca4fa", "value": "12288:zNYl/0Val4vGewiuEhplWVzMu4I7x+I74TGP/jOXpwzNqVAIalcX9K8lWFcf6TGY:Il4vGd/IAt7b/yZwhXILf8NSk/v/hAwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785359649, "uuid": "4824746e-11fa-4d27-9861-5aaae253dd39", "value": 967077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785359649, "uuid": "b90ecdf0-44c0-4637-9def-6af90ab09e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359649, "uuid": "ac25b3d4-8f43-4b48-87ad-974d6b0cd348", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f110150-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327381, "uuid": "f7a39b04-bbab-4fb3-8099-86816e5113cd", "comment": "Malware payload", "value": "5e2455bce1d789f366f486349a527ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327381, "uuid": "0d3b3ea9-d634-466f-8809-e54a0168538f", "comment": "Malware payload", "value": "5c33e3dfa983e99e0dc1618fdf7893c43182d6ef079f34fe3c94887b63ab274c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327381, "uuid": "ee218bee-4893-4221-b0c5-9da494a3b1d8", "comment": "Malware payload", "value": "4ca51948851ab238891a8a64816e7e1d1f87d342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327381, "uuid": "bb4a767b-d286-4bec-8e09-396fd8a24774", "comment": "Malware payload", "value": "a0cdfbb255d9bffe2eab40a1033319138f733995574a4b3e42b4a0442d5137ea7fc066fc6dc68329dc0717fae07dec8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327381, "uuid": "813a84c1-e7d9-48de-b11d-77108aceacde", "value": "T14674AF31B2D200A7E31A86F06C7B07024E2DFDD5E66945EA5D5C09EB2E257B0836BFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327381, "uuid": "5b3e1b5b-bcfa-495c-95a2-25d47f81ed44", "value": "cc17bcc7fe575a59b90e88841fe76dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327381, "uuid": "ac2ad470-35e5-4904-badc-5e1780267099", "value": "6144:sAUD3c301f0e2WwBk0JNV1SGuJKG/PuTwdGEcxC8CZtZ51/p:sAucE50eQk0nBugjTwdGEcc8WV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327381, "uuid": "3f32e818-f1cf-4485-8ab5-cb88b4418d3a", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327381, "uuid": "1f572f65-b34f-4c7b-92b4-23bc78411d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327381, "uuid": "0ba4b706-ea4d-4516-9dc8-7458c6074ed6", "value": "5c33e3dfa983e99e0dc1618fdf7893c43182d6ef079f34fe3c94887b63ab274c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ba260b-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785358604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358604, "uuid": "9f5257cd-33b9-4071-8b7f-f17036e29040", "comment": "Malware payload (Mirai)", "value": "2bd7b0f48a59cc62986f4f4e48b40727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358604, "uuid": "b9567943-fce9-4378-90b1-5b702f5ec5f4", "comment": "Malware payload (Mirai)", "value": "5d060c6fbf2dc9bcb1131452aec575fc921e64c88828dc0faa78a9a09770e551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358604, "uuid": "cb4b1764-b219-42ec-9167-f5a340d1fcfb", "comment": "Malware payload (Mirai)", "value": "d8adfcd6f82d766d6f7a9c9e117cf6a99063ae56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358604, "uuid": "29656fbc-3a3d-4d49-90aa-04d191ba0c69", "comment": "Malware payload (Mirai)", "value": "8792073765813bd4a8f16c002141865d36b1da8b34fab21d2642f750f4a148502bd94706670facdd4c2ae70043fa5932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358604, "uuid": "7ebda00a-9d55-4cef-a3ce-314a258b12c3", "value": "T13E058D1BB2B3B6BDC01BC03047DBC6714532F0756A322D7B27C49A383E9ADA5171AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358604, "uuid": "dffdc37a-4d2d-4d22-9fe9-4f5f385f5582", "value": "12288:Nk5FWXrqxfxVetWTPR2aNgT59NnYdkH8Zqej2aL76b/HayUN0HXdqaBwhcq:NvXrqNxVeOPYaNgTz5aL7a4jaBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358604, "uuid": "81e88397-3617-4996-bdcb-4fa856bb13fc", "value": 840416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358604, "uuid": "b578d7f7-80f9-4a2d-9d2c-0d7f962b881a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358604, "uuid": "49975cd4-ced7-4053-ae24-313f1bcaad53", "value": "real_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56ec86c-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333163, "uuid": "e1f9688f-07e1-4ac4-8dfb-8ca0d5e55611", "comment": "Malware payload", "value": "f99e3955a0cce503b9db1553eeae8115", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333163, "uuid": "48f9c565-3483-409a-838b-da3737ff1e12", "comment": "Malware payload", "value": "5d137489edcdbc4b20793c71cd8a189db91fc960e8aaecad3c32178c6b403fa7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333163, "uuid": "7be7cb07-b3e9-4b17-be7c-130816162284", "comment": "Malware payload", "value": "e5f8e3609af6eea610f0a035fa443b05faa188d7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333163, "uuid": "ebdb6c99-b4b2-4db2-9364-0fb21a6afc5f", "comment": "Malware payload", "value": "0c60548e24a45177c8b0766ee097c7aba2dc0d0ff8e5577f6a7b64d02ad5e8dcd55025f082f843d9fcf0faf34764917f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333163, "uuid": "4b69fd2f-790d-4dfb-b14f-e2c46bfb45ea", "value": "T137A3626979844EB906CF812F45C78041AEE2A05F5A107C3CB85FD468AF3BCD4B6FA2D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333163, "uuid": "eac47c57-1f16-43fc-91b1-e6aee0c0ea5a", "value": "768:h0Vp0rgveeIXnLtw4RaFfND9UEjHAw3sebKuc4HdweotThw5YIUBpsdKCn497Dcf:h+0rJH3RaFfxHAi1r5Hdweu2d549sJXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333163, "uuid": "f7f26005-84de-4901-a20b-1c4d92b630da", "value": 104326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333163, "uuid": "e3f84e4d-7156-43b3-a91b-276846e65661", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333163, "uuid": "87b70553-ebac-4905-a954-b98abae6c35f", "value": "install.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab747e8-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333037, "uuid": "56c48681-acea-41d1-ba78-5368c57b6bba", "comment": "Malware payload (Mirai)", "value": "3f678081c88a1d7e57520875c1c9e12d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333037, "uuid": "c69b46c5-d01c-4c56-ab4e-3b6633b8e023", "comment": "Malware payload (Mirai)", "value": "5d80e16b1d2a1a82afe8ab89c2d31bf51cd0965f5fdc658ca155167b4c30ae3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333037, "uuid": "fa89ce32-1e6c-460b-b4af-3a20fa14a9b7", "comment": "Malware payload (Mirai)", "value": "5808d8d832a5e07599b556d23e36f63923fe3279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333037, "uuid": "fc710500-b1b5-4a64-ba0f-550d78ea7d97", "comment": "Malware payload (Mirai)", "value": "7191819decd05d5bc214e166ef9aa4e35ccaa16d28ee087c5056336762760b910576dace1ae268eaa701a187970aa891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333037, "uuid": "2ac75440-117d-4ad2-80e4-dd89a5cd2146", "value": "T1B7D312755D303620D8A47EB9BCB7A831DBEDE6503BFC213F218656F905938610E1D2B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333037, "uuid": "be7d7a8f-5ba2-4a89-9b4c-144f0cd988dc", "value": "3072:2O7qPuXXxzxeKk9Tkjzgi57KyKhFvhKkWaxhZ1J9M7khvW:2d2XXIdkdahFv7WaxhZ9M7khvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333037, "uuid": "39499449-96fb-4951-b11b-a445396bdb4d", "value": 133196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333037, "uuid": "226706e3-cf68-4c14-94c7-9b6268aa8877", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333037, "uuid": "bb430e33-0366-43e3-94a2-2f828f755e4a", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bf2e0a-8b88-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785355500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355500, "uuid": "7fc27964-ce4b-4a8a-bff6-1f5abbaa4b5c", "comment": "Malware payload (RemusStealer)", "value": "d80e3c2a8ea8635e6337f6527b0bb4ad", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355500, "uuid": "1fff0404-1d73-4959-a11a-3fc6d417e82b", "comment": "Malware payload (RemusStealer)", "value": "5d9ed51e8c68d43b9c2f8f6c9d18eef8f808a6f872115765a4cd2b43660cad8f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355500, "uuid": "1407aeca-7734-4f2d-a2c0-5872a8e3f713", "comment": "Malware payload (RemusStealer)", "value": "38afe2a4fdf706cb6f901e1cef624a673f6af165", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355500, "uuid": "2855979e-46f3-4f33-84f3-a34c16c00c0c", "comment": "Malware payload (RemusStealer)", "value": "11ef4f75e0f43dac052b0cf89df364b43c130df6bd1071b670ef9f3ea836585cfe7586eaf6aa1acb751b103eb453deca", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355500, "uuid": "6c9b0046-94d9-4873-8d67-7dc7ce9514e4", "value": "T1194523D9374A5550DC215B3D0629C27627EEBCB74D92A409BBD5FA2C8F39AC01043AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355500, "uuid": "9ab813a9-df16-4e1d-83de-480fa1710d42", "value": "24576:Kh+7ToO+67FF/H+zSuHLk+6J/nXABk9dtwQnTKyiiRh7HdGM:YbOTBF/H2SurAXGIdtwWuyBh7H9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785355500, "uuid": "1d57a02f-0d93-4943-b49e-f0971b6aee15", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785355500, "uuid": "bd7691a3-d81b-453e-bfd6-944f8406fa8c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355500, "uuid": "9f0d0a22-cfa5-45ee-bd38-95f7484791c0", "value": "package.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accc0347-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324531, "uuid": "7b44ec56-c057-427a-97c3-1676ded16381", "comment": "Malware payload", "value": "ccb37f42ccfdd0d895024c9b97e0d4ec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324531, "uuid": "a2a7e2cd-a1bf-4074-b8d7-f6ef8393cb95", "comment": "Malware payload", "value": "5e361fed77e942027e81e3e3f06d7cfb3757600103ae754d21e0b6266cd885d8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324531, "uuid": "0be7ba8b-7d6e-4bc8-a941-67d8dc58eb45", "comment": "Malware payload", "value": "84ae17c92cb232da4e297359476de1c40baae6e6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324531, "uuid": "439a2cb9-dccf-4e48-a26c-dc5a0b9fa639", "comment": "Malware payload", "value": "0bc7c6f7c9af9a306b0d42c8382acca18a1722d36ae8acf179c0472ce026d0c26da29cf5abd40e2e28d05ea013d959cb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324531, "uuid": "3fbb6ce8-45dd-4085-a28b-1199feac0709", "value": "T15C21B631EE164437D72F977E5C44CB013524B2F97763094797A642992ECE2741B8083A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324531, "uuid": "bcbdc95e-6aca-4462-81d3-ca462d05dfb6", "value": "24:9Z0UIhp8P0GnYxeXs2T/bfmkL9wbW3sW8xao/FOLuYhSZyWwWbv:9K188GnNs+zfTZh1ujkN04kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324531, "uuid": "45e04529-3fbb-49e5-be08-b6aee3e1c638", "value": 1418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324531, "uuid": "4082ffdf-6f69-4dd5-89ce-8acc9c6c37e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324531, "uuid": "ae2aedeb-7f96-4703-a443-25d819b423ae", "value": "photov_916977827646.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4f0b17-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload (AnimateClipper)", "timestamp": 1785321338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321338, "uuid": "131087d9-dbb1-4349-83f2-cf8fe4f2e1c8", "comment": "Malware payload (AnimateClipper)", "value": "b8d28b59c891a75a318dee8dc16dbcdd", "object_relation": "md5", "Tag": [ { "name": "0fe19d81f52f124d2c456dd80e299f9d", "colour": "#79D402", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321338, "uuid": "61b8ba2f-b5cc-405c-a9be-689f29aec1f6", "comment": "Malware payload (AnimateClipper)", "value": "5ee86cbcd296e0998ca20ee65a7506fb3baecfb7ce98eede29bff1a6a6e0fc95", "object_relation": "sha256", "Tag": [ { "name": "0fe19d81f52f124d2c456dd80e299f9d", "colour": "#79D402", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321338, "uuid": "f46fbae8-e83e-4289-a761-b52e3e8ee75b", "comment": "Malware payload (AnimateClipper)", "value": "745ec020a3fae9e24921579370010fd28f9bd25f", "object_relation": "sha1", "Tag": [ { "name": "0fe19d81f52f124d2c456dd80e299f9d", "colour": "#79D402", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321338, "uuid": "6f84a17b-382c-4636-ab6f-775f944b9700", "comment": "Malware payload (AnimateClipper)", "value": "37a054290f225e721d790b1f41ddb19440d00ad497a568963047240b2779753f5b4fce04b4e7e580ae493b4c88be2fab", "object_relation": "sha3-384", "Tag": [ { "name": "0fe19d81f52f124d2c456dd80e299f9d", "colour": "#79D402", "exportable": true, "hide_tag": false }, { "name": "AnimateClipper", "colour": "#AC97BE", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321338, "uuid": "a60d81eb-0c90-431a-917f-fcb7dc3d8710", "value": "T1B5B68C1DA29801E8E6779A388AE37E32D7717846076DA98B0758F2053F33AD05B7F315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321338, "uuid": "c2bc9a50-dc69-4ff0-9bc5-1948048c6d03", "value": "ddd051506cfe33d151858512722b97b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321338, "uuid": "2952671e-5092-4e25-bebe-646c7d5dae4f", "value": "24576:F9fuOb193YKMT7iCtQ4bDfWbZkFSdU27PTCuOH/YIY9Ib8qkqKSPLftRNg+au1nj:F9fbb193O7zmZIavTNOrY9kFRNl1vfVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321338, "uuid": "3c9691b9-cc03-42a8-a8cd-3858fda5316a", "value": 11420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321338, "uuid": "baac2667-c2cf-4b56-b926-fb3455c70094", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321338, "uuid": "e791986c-1bb9-41e9-ad73-679e99dc5c48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ddef23-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307123, "uuid": "c1aec30b-6e47-4759-95ea-0d759dd097c1", "comment": "Malware payload", "value": "e26393d3a21cbca0fcecdfe9bae2a1c2", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307123, "uuid": "653c9b7e-aa09-4c04-a96b-f65120c257cd", "comment": "Malware payload", "value": "6029c8f5566feada8ae7037f35c70640428553e04e8035487d7b98c1f5c26f9c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307123, "uuid": "8fb0d36c-66d0-426f-bfad-f56eba754ed6", "comment": "Malware payload", "value": "e2aff823704a79ce4efd717da4d3fe13fcd2f0dc", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307123, "uuid": "df8587a6-c30c-4a33-ae6a-661b790b47b5", "comment": "Malware payload", "value": "37dfc8be7918f350a75138505b2162f2754701d257a8b12506e2b7618d332fdc20a64e0d72aaf83b801d1dd6f35a3864", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307123, "uuid": "e0652f08-3953-4006-82fd-2462964f280e", "value": "T1FCA20A2372520DB683C13A788CDF5109F3A5506B910E2FE4B9CC8391EF75A2993F9B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307123, "uuid": "b5c4d8cc-bff8-4a9f-925a-536b0f0bf567", "value": "192:allyRe6DLvchmD7L829iIJBwsfpBBvPFz0T9n7BIdQIQOc5yIxTb7LbupBoI+Dob:acBBHuO2dSMoLgjooKbwixZDpxCRoj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307123, "uuid": "eaaf65e9-43e3-4132-a005-5b85bf42abab", "value": 22200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307123, "uuid": "34abfe44-da0f-4be0-b80b-4dcbdcc039a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307123, "uuid": "b0b4a80e-76e3-4e2f-a087-ef4276f699a0", "value": "28072026_0701_tenis-team-km.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f37fe1-8b3c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785322713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322713, "uuid": "cd57139b-0f71-4ae3-827f-136163537f53", "comment": "Malware payload", "value": "747fa4509b5cc2360a2724308cf7750c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322713, "uuid": "9dabfb80-578a-4da1-bcd8-6a8a9684f1ea", "comment": "Malware payload", "value": "6042e01e3670bad16131f4f2d932cfdb9c9d01a9838447ff2a006a09d409adfa", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322713, "uuid": "62b6317e-9a9e-4a19-8f31-d84b6ca0e18e", "comment": "Malware payload", "value": "1b410238ea43cbdbc58cc0bc94bbc7833826e9df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322713, "uuid": "d832c7f9-1cf2-4584-b6e4-74e4a804109e", "comment": "Malware payload", "value": "5f50af698ede1509467506833b2cd957c3581f7518242674ea6f3e61d37e8f8aff799cd5d42ec4f6eadfef25ce081d58", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322713, "uuid": "6d5efa35-cca0-49a2-94df-03623f0e4988", "value": "T12A1633E365904393E338F21A84A76E5450D6575F890AA1911FEB03FED3B725DCFE80A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322713, "uuid": "84868f02-3c5d-42ef-a803-f3e10f6acdf1", "value": "98304:uelhHkyoYGLzfefeRjqK7RtwK7+a6a8D26R0N9oOg4ZT3+/Vt:u0TG3efesK1qg8S6CoO7ZT3iVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785322713, "uuid": "50d732fe-3dc9-4aa3-bc8b-bb8603dc19a5", "value": 4176665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785322713, "uuid": "df7dbb7a-3589-424c-9571-87fda878c77b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322713, "uuid": "ef439801-1a89-4dde-a7a8-fa4c8af09233", "value": "20260729104350.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2731ff09-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323878, "uuid": "5578c4e8-6333-41af-88f9-69cdb0bc0642", "comment": "Malware payload (Mirai)", "value": "092ec547871daa5c2cd8cbf1d6fedc67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323878, "uuid": "73d3b961-18a2-4a7c-9b03-069a006322e9", "comment": "Malware payload (Mirai)", "value": "608c40e5ff9b0dd4d601d0a81751e1dc5cfa0f28dc526c1cb53d5d0898579199", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323878, "uuid": "19452d4f-d367-4894-a023-c171c6714345", "comment": "Malware payload (Mirai)", "value": "311013b54ce8cade310c61da3b7692ff31270feb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323878, "uuid": "21b817d6-17b9-4e65-bf49-3c4fed44c4f5", "comment": "Malware payload (Mirai)", "value": "18d962a07be449ef4ee785edf72602754c9ec895d5f1fab08088fdd443569e931712c97f24408464cf4835a5db7aa236", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323878, "uuid": "913df09f-59a9-4f97-810a-3f1b0ce630e1", "value": "T1E4831982BC41A629C7D0137BEAAF508E3311B7DDD1DA3243DC254B647ACA91F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323878, "uuid": "73ce9f10-c580-45ae-ae6b-5e504ecb15e1", "value": "1536:r2mYUaUta2nvKSH7vqgeQkytNXgCsMTjbpipCB8t46iyBs9:iXUaUt3hqixfbp8y841y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323878, "uuid": "8e565d9d-b457-4aed-8812-7ad78b7f2b10", "value": 81560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323878, "uuid": "8062aec0-ac4f-4960-9d9f-1b9f79a3d765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323878, "uuid": "6c5c184d-2bff-4077-904f-6371009069fe", "value": "MMaaRRiiOisecTanee.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83377b8-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351582, "uuid": "f172acba-895a-4598-b653-0dbdfed19acf", "comment": "Malware payload (Mirai)", "value": "ecba457ca32e711eee309f23c9eb1957", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351582, "uuid": "b24db32d-197f-437d-a4ff-8a82602b1287", "comment": "Malware payload (Mirai)", "value": "617d527bf91956db918dc80c769b79d0d9c6dd980b9c9419773575e2c166256e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351582, "uuid": "5c04696e-7fd0-489d-ad71-5e8d5e8c65f6", "comment": "Malware payload (Mirai)", "value": "c1f68fedfc69c53ec8f67d8fcdfb079dc9b7d121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351582, "uuid": "142064ab-1239-4747-9db7-4785d4797df1", "comment": "Malware payload (Mirai)", "value": "6ed37fababdb0385bfa0e27183a6e04ccaf8ef5a67d8283a891cc405213416aa267fb97ac4800d0369a64987beb1d72f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351582, "uuid": "3b749a85-0385-451a-96ea-05c92be559ee", "value": "T159C32B99F890DE52C6D52579FA4E428C332317B8C3DA7206CE245F3477E796A0E3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351582, "uuid": "0354f483-00da-4fe0-a53c-797f8eba9502", "value": "3072:cUd0Vj8OYfoBiNB5CEUQ4g8O7MQCChczz2ylVktrD5o5aA1Dz:c+0KOYrUQ4g8OeyylVY/5Samn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351582, "uuid": "bea225c4-b676-4111-87e9-9c0d11f8ee7c", "value": 128464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351582, "uuid": "92974c16-0a9e-4d35-af0f-71d3d764cfaa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351582, "uuid": "89b5c151-f7f3-4c19-8c40-cb685e495046", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfe71813-8b0f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785303572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303572, "uuid": "d6fdb942-dc20-491d-baad-0e93e40df5c2", "comment": "Malware payload", "value": "64a641ced6dd182ab15acaa3f7b33063", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303572, "uuid": "77137520-d3e5-4197-a57f-618936db0061", "comment": "Malware payload", "value": "6197de9fe8fd531ba4c5a5fe54718b01294cff013bbf56ecbbe680ac5ccd4eca", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303572, "uuid": "faf585bf-4d47-4760-a1a8-0947a6f146dc", "comment": "Malware payload", "value": "ba399050fd14e98e60d6f855e048aa990ec783af", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303572, "uuid": "97aed55b-0cd4-497c-a671-2ce11a933a18", "comment": "Malware payload", "value": "3c2264e1d0bb8ae1acbc4df65ccf4f61c83de653c9162f0c7937efae270e920d811783f4e35662ce622a76267b2ac49a", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303572, "uuid": "b57a44f2-bbe4-4eda-aaf8-54a0dea1e2c2", "value": "T1A5542298D78E00A1CF64A73B43574A4989FCB73EB30046A670AC537933EDE3D5926879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303572, "uuid": "aaa63e85-34be-4f37-b6d9-48fd110ffd6c", "value": "768:mczy84fJpvdSAl6SVqAO3nAl6FRRVcsk09CHJu:KnJR8AlzVULV9k09Cpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303572, "uuid": "ac2620f3-c520-48a6-b4c1-88a635c37afc", "value": 279485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303572, "uuid": "2de43b52-0448-4564-a75c-ce16955e015c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303572, "uuid": "ad0b810c-7f35-4420-9943-934965887617", "value": "2607281ATC.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2ebb6c-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320856, "uuid": "61c023e3-32d4-453d-bbca-5e452e6cc347", "comment": "Malware payload (Stealc)", "value": "a8480ece517b8367ca8418d7888f410d", "object_relation": "md5", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320856, "uuid": "346cae9f-18de-4b8d-b265-34cbdc4a1057", "comment": "Malware payload (Stealc)", "value": "61ab1d22949eac0582e989ae065ec4caee9ac99998276317edda96735cd311fb", "object_relation": "sha256", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320856, "uuid": "edc6e51e-49de-444d-83c2-dda665aea504", "comment": "Malware payload (Stealc)", "value": "49802c5598b2e9d94229ae987d0ac47bbf8977ea", "object_relation": "sha1", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320856, "uuid": "419c08a6-b083-44cc-a506-b44c909bfb36", "comment": "Malware payload (Stealc)", "value": "d24f3fd995a45cd7644ce689256ce104a2e5e929245157724d3906f29a46a761488ac47586570f14533daa5c2535f41a", "object_relation": "sha3-384", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320856, "uuid": "6ea42cb8-19ad-4d5f-9407-598c067b563f", "value": "T193F35C4BB7A530F9E1778279C9224545FBB3787547609BEF03A442662F232D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320856, "uuid": "bb3b6784-7067-45cd-9cd0-6bb40e0392f9", "value": "e56503171a96d90d771b2457aef8d39b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320856, "uuid": "8fd98bd5-da7e-48b6-b10b-5e4030bae3ea", "value": "3072:oO5LDhr1HFWA7l/7/GKIAq/Jyjr1D6LxDsUM9Pvw:okHhr1HFjlD/GtAqxhZuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320856, "uuid": "e3a1d5e6-dc9b-47ee-880c-68a81b13908b", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320856, "uuid": "4fec0acf-83b3-43d3-ad54-ffa6931778ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320856, "uuid": "21c5c4a8-253d-446d-a2d5-128d8064130a", "value": "61ab1d22949eac0582e989ae065ec4caee9ac99998276317edda96735cd311fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e93917-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload (StealeriumStealer)", "timestamp": 1785310825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310825, "uuid": "4b2e3ccc-269f-410c-bbf8-6ebb8acd4cfa", "comment": "Malware payload (StealeriumStealer)", "value": "6d141be8566a768dec036c4a6a173f6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310825, "uuid": "7c1b63d3-48f3-45ab-9c69-c270294d86cb", "comment": "Malware payload (StealeriumStealer)", "value": "6231e3ba7d5643ee173f92ef33d2dafa4bc2986954b16cd53195a3b87e3aa5a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310825, "uuid": "482400f3-9ef8-4325-95c8-d4ca1f24646a", "comment": "Malware payload (StealeriumStealer)", "value": "6b64adfa7ff55f72a024342e54f9cf34adbadf78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310825, "uuid": "60460960-2b4d-4240-af7c-4d7c0be2cc36", "comment": "Malware payload (StealeriumStealer)", "value": "5de8f866327ff5042bfb0382651ee9173c8ed6b70c089e09ac629c3629a89fc5b447500488806e8c02f91ed373db3ef3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StealeriumStealer", "colour": "#80BC0E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310825, "uuid": "c76287cd-5e3e-4fc9-93cf-f6671458486f", "value": "T16776334463FC0659F1BF6B78E87162119E32B613D43AE78D198C119C0A72B82EDA1F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310825, "uuid": "95941d27-c78c-4b93-85fa-005159c55e95", "value": "196608:rr9uV25DeTD+oqzukSIlLtIY79n8SI75bWAXAkuujCPX9YG9he5GnQCAJKN:1A403qakSoR7tfI7ZtXADu8X9Y95GQLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310825, "uuid": "f735fb5b-054f-425d-9dfd-05e4f4167d0f", "value": 7371776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310825, "uuid": "8c33fc2c-36e1-4712-823d-06d7208137a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310825, "uuid": "a39d8a1f-17ac-4f73-9e9b-55d8d213f474", "value": "MATCHACRACKED.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f768ce83-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307477, "uuid": "72b4bf43-0258-4f9a-8a12-f6a949772bff", "comment": "Malware payload", "value": "cf616997f9a73822c32113e9c598de9f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307477, "uuid": "b7c542c6-fcd3-490d-aa62-36c9164f78e8", "comment": "Malware payload", "value": "625e851b03c82ce9cfccddee99e8cf781de81afcdb1a89904511e99ccb960ca8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307477, "uuid": "7bc6fea2-3eb7-40b3-8e14-da59d86ee21f", "comment": "Malware payload", "value": "7bee2605f3293d3b527f9499c2b697a679a9fcad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307477, "uuid": "1aa6daf5-a7f4-4040-979e-72776277e7d5", "comment": "Malware payload", "value": "c56566a3aaafb9f690d5e45f9655d1ea6561adfe0c5b37ab1cb8d18c21bc50fc73289069760fe9bdaec626765eb5839e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307477, "uuid": "8866e407-9737-4b1f-a7b8-8392e6e1dd8d", "value": "T15721837147B84096EF83F574E4CBAE5A3B8E699962D26703190C06AA29BB7118D4A0D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307477, "uuid": "cb2dc8bb-e76c-4996-89ab-a1ae388cec40", "value": "24:99jzObBYCGhoZ+oWAqhs+qVqgieFng5XQ42W+2nJegDErQvVzocq024r9iBXu9sU:99IBYCmg+jAmqVqgieFgtQe+2cg6QtXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307477, "uuid": "5c3cfc9a-6636-4702-9b4a-145af968e932", "value": 1341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307477, "uuid": "92a9dc18-e13b-4c94-aa39-357d02a48a57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307477, "uuid": "09517d32-8ffa-4ff4-a5aa-bafe44b849c2", "value": "images_20260728_172152.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfca624-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785311538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311538, "uuid": "2feba460-6f46-45aa-b4f9-9d4ab6209280", "comment": "Malware payload (Mirai)", "value": "66b30da3cfbc952aeb2c090154fdc14d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311538, "uuid": "39dadae7-e48e-4bfe-b6b5-b4fc0cc277e2", "comment": "Malware payload (Mirai)", "value": "6284528c4a3bd859b83fb286f7a65e06ee5bb77e970e933c2671c23eda636017", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311538, "uuid": "7ddbe836-ac09-4476-8a10-2acce0248804", "comment": "Malware payload (Mirai)", "value": "dfb311d76d5ed75d0a062d69b3ba7b6b06db9f97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311538, "uuid": "c3353f8c-eedb-4a46-b530-b20bff99f44e", "comment": "Malware payload (Mirai)", "value": "2f0a543ce5b06953c7b4c6ae36f485769ce8b0fe9a08498980b4c82c01253003f30fc37a6e1525b83d497e926576e6be", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311538, "uuid": "2c90535b-f034-45f3-883b-2ac9738448f9", "value": "T1E853299AFD00CD7CF81AD77B84134E06B272B75551421B3A336BBAB7AC721A45D32E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311538, "uuid": "f079a3df-b4e3-48d8-8456-fa3fe99bedb6", "value": "1536:rhuqwv9Cm8LMyLJ5jRAw2Yp8hRoTnb6NUsLrC:3wFXyLJ5t268hReQvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311538, "uuid": "d091bbaa-8962-48cd-8023-dfaa3038076a", "value": 61728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311538, "uuid": "c214182b-6306-4f16-980f-919f3a19c096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311538, "uuid": "d8af2849-939b-4832-a8c9-80e7e3b05ed9", "value": "real_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e068c6-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785358611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358611, "uuid": "ac6a5dee-fbd4-4be8-b2bb-1ddd5080b7de", "comment": "Malware payload", "value": "eb9e804816df12760731d1a72089a1d9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358611, "uuid": "157dd1d0-ee9d-465d-84a5-2361038a9a9f", "comment": "Malware payload", "value": "63898fa3645e69a333f8ea158d0c4e7bb20a4265f0d4597f50ee2ffffc9df820", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358611, "uuid": "a0352395-6b48-40ed-8921-71bdaf75d860", "comment": "Malware payload", "value": "d7888df63014c0828ab8fc9bef4702990940a7aa", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358611, "uuid": "f7f8becd-2485-416d-87b9-797c34a2a4fa", "comment": "Malware payload", "value": "8a1fc033ecff32919d96cf1c46b4b67033c32577c28b2a6d359e6d3e02e0d1484dddee0b675f30b6fa95a6b6e537b886", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358611, "uuid": "e4cc6983-d2bc-4a00-aedb-36fe711bfd48", "value": "T1E815126BB308B8EBD6FF553FCDA398E802775E34C44B658B4850B6A401B33E6D709985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358611, "uuid": "31130f34-5f1e-4412-a35e-0b05a9a27fab", "value": "24576:Dak8Dsilas9ZgaEjJGeAKXV93EqzOMMBIIIYee8MMBIIIYeeT:uke6sLgaEjjl93ES3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358611, "uuid": "d1736edb-fedc-4f1c-9760-4ccf5032c92e", "value": 899746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358611, "uuid": "7b58ab19-9ab9-49a7-bc34-618c3672142b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358611, "uuid": "4b59e744-ef0d-4f01-b005-387b3d9d1aab", "value": "SexySwipe.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c6a72c-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785311534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311534, "uuid": "831574dc-467d-40bb-87e3-5da21d34601e", "comment": "Malware payload (Mirai)", "value": "6a2f1d4665f60d1d5633b2acebb57c33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311534, "uuid": "0a12c961-054f-40ee-bfe7-e2615cb0f27f", "comment": "Malware payload (Mirai)", "value": "64634ceeffb1d01ff9ac39164700fcfc535e08209d289b58b66582c5801ce24b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311534, "uuid": "522227f0-5b30-426f-82a4-10df69f2d292", "comment": "Malware payload (Mirai)", "value": "c65c220205b8eba9208095461053f9515057b684", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311534, "uuid": "bbcb5fb2-dbf8-4e64-b5d3-19b16f517e9c", "comment": "Malware payload (Mirai)", "value": "446395cc7de5267d2db75589ba94a02ebe94dcfabc75da6fd0ab07c36e8f20bc87e333e4b337355ed16031437cace428", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311534, "uuid": "ab4a0c74-8b91-4e14-8135-dd2297175931", "value": "T168434A21FA721A17C4D465BA61F74334F2F6474E34E8CB2E7D620E4EBF206402A5B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311534, "uuid": "6495f771-2804-4df6-953f-4bec4afac4cc", "value": "768:Cyo/R2CFDPiIDDK3g5MpxO+C8+beNFa5szoIRg1tKIlm:CyI2CFOIK3cMpBv+Yg5s0FtKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311534, "uuid": "a79be9a1-6294-496e-b0eb-3613a8a97c67", "value": 60008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311534, "uuid": "58ced694-1ffb-45cb-9469-04db8335f495", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311534, "uuid": "ecca99dc-9894-4b36-adf4-f9cfc367ba83", "value": "real_spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8076e0-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785349900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349900, "uuid": "733414ea-1e11-46ba-a642-f3d3c42004f7", "comment": "Malware payload", "value": "509e191b48c2ea4f4d1387da76d856f1", "object_relation": "md5", "Tag": [ { "name": "Basic", "colour": "#014C23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349900, "uuid": "89126c0f-4d84-4a12-a921-b6ac0040c3ec", "comment": "Malware payload", "value": "6473eb6ce8a8bffb6599c9a71820e66b55a71ab58e203036ed1e47c205e7278e", "object_relation": "sha256", "Tag": [ { "name": "Basic", "colour": "#014C23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349900, "uuid": "aebcd950-6525-409f-9f8c-cb1bb81db175", "comment": "Malware payload", "value": "f1542cdf6378252fe64e4cedff4ef2995abc3935", "object_relation": "sha1", "Tag": [ { "name": "Basic", "colour": "#014C23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349900, "uuid": "7d0b7697-f26f-4a00-bbe5-5008c55f5be3", "comment": "Malware payload", "value": "828a9c66fe7973a7eb840aae5dbc532fee8fa40d0b5a4c69cd81bf004b260393117ca57e2860f7ab82914a395f5b1f6c", "object_relation": "sha3-384", "Tag": [ { "name": "Basic", "colour": "#014C23", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349900, "uuid": "66a341bf-ae02-4119-955f-7d890433dfec", "value": "T15F5523B78BF218AAF78156FE04D60684D7EA74A1196337033312F5765C017CCEA68ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349900, "uuid": "b72afb2d-02f1-4bf7-accb-c65035282d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349900, "uuid": "1425f485-27da-4e74-95ae-dc2cdfaaa645", "value": "24576:xUkuCKN1D0fJOWS8Spf0/vhCJt5UkuCKN1D0fJOWS8Spf0/vhCJt1:xXGSAMS5/5XGSAMS5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349900, "uuid": "aea73163-cc11-4a86-b63a-42269391bb2b", "value": 1370624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349900, "uuid": "6fcede0e-a664-42fd-90f4-a411f0a61da8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349900, "uuid": "fa8f3612-b108-44f2-b8d9-ec4382312c93", "value": "TgWsProxy_windows_7_64bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7affc32-8b9f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785365432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365432, "uuid": "6244efaf-d451-4292-b352-98ea23482626", "comment": "Malware payload", "value": "ac8ce65b832f068c06f4dc4c7b0cc7ac", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365432, "uuid": "3d124ae6-c3a9-4e0f-9a72-7aa0b4e30f9c", "comment": "Malware payload", "value": "64d7a96e4307457cf9c2efdd4990bcf4b5a215cb60fb8c36ebb46d1ac01f12d6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365432, "uuid": "86898234-db95-49ed-b43d-f5d3790fc41c", "comment": "Malware payload", "value": "f594cd58e9fc69721a93847c82205d09cba50b09", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785365432, "uuid": "2d422586-a115-490f-be02-5e08b3ff98ba", "comment": "Malware payload", "value": "9bb22aab55e19c6268b783e1f1d379d57f694c1846e29dbcc017b5ed75e488dc9a8e4fda6baaf3c91f8476330dfb5145", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365432, "uuid": "6d6545d0-ebae-4ba7-aa13-2815d39a7720", "value": "T144F55A077CA048E9D0AEA33189B652917B71BC094B3533D72FA0BA792F727D19D36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365432, "uuid": "5e897d7a-4c45-47c9-a095-a0ffeda1685a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365432, "uuid": "85de7f90-4f50-4fa6-9005-cfb046fb6162", "value": "24576:l17mSX1SO357SsP63HmVWAm5/ylxmimpuFNcsB5CbjnlfzBele5rKDm7j3c7iTLy:l179X1D35Wq63kWA5bm3puY2Cbf7xO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785365432, "uuid": "72a6e562-baeb-4c79-bcd8-015a601a3458", "value": 3496296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785365432, "uuid": "509de606-87bb-462a-9828-0e4d2468e0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785365432, "uuid": "a79949e1-a070-45d2-a0ef-ff965e0235d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fe53bf-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307367, "uuid": "2848d8de-2b4b-4293-9ae8-3f913c6932c3", "comment": "Malware payload", "value": "9a77a4848423cd7ad5b4b7e07670b27e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307367, "uuid": "c584aceb-d782-47dc-8f8b-dc053a799445", "comment": "Malware payload", "value": "64e2aa64848826b96ce1034752ff390df63eac2f88c2dbb9c0d7082e94475450", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307367, "uuid": "fe9dee86-a607-4e0e-aab4-66a214874af7", "comment": "Malware payload", "value": "7b2cb10bbc4d7fdb1e410cbd81dc54ed39447a97", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307367, "uuid": "6e6c3d55-aca7-4131-a1b8-b98a6f99306c", "comment": "Malware payload", "value": "57d3b28326a4ebd789dc56092c07d03d6a8201146fb5113ff054207fe64817c6d3329ba3ea50b6fb6ce393869de0a849", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307367, "uuid": "9ba930bb-4ef2-4ebc-85d7-acc821ca31e5", "value": "T1F402BFC457320A1BE7F9776AE9428E6E73D5C4076F935F9AE5A33F42480882E06340D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307367, "uuid": "6ceac3c9-171c-46f7-b84c-935fce8a58c2", "value": "192:u31szPrPXj+GCVCIPdHP71Rayk9rpHvS2bSN:qozPXj+BHvRwpPS2bSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307367, "uuid": "12cae4b1-0de4-404c-a5ef-3cc70c3e55bb", "value": 8311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307367, "uuid": "df9182f4-4997-4c8e-a2d8-7630a2c3582a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307367, "uuid": "120f3660-0a32-43a7-90df-d7eeaed9ce0a", "value": "images_20260728_175040.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc19954e-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324557, "uuid": "f0274cec-b43c-4d13-9caa-ab3b5e21fd76", "comment": "Malware payload", "value": "ac877f1aaf489bf21076652745ccb6fe", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324557, "uuid": "a8bfd13f-e90e-4a48-96ae-8b1887ebec90", "comment": "Malware payload", "value": "65a8f831e009188555486aae3544cdc71bb4669d132d9a3314dbc7b31b8d8932", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324557, "uuid": "953c6e19-f1a5-48ba-9eda-161bc628730c", "comment": "Malware payload", "value": "3ad3768574a2e3dcb037811b041d05bd22c39e18", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324557, "uuid": "f88b8002-8301-48a7-b626-15815e9858f2", "comment": "Malware payload", "value": "4326d1821b921024854e6565a12d2fa0733189dcca67cbb1cdf650cf2f89a044c176828292c0f6068bc94239ec2aeda9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324557, "uuid": "7c7e0573-dca5-45c3-89d3-2e6e05aa9be7", "value": "T1A431C930C1DEEF50D6E7B234FE6E094A30B2C72B965A8227A67CD6C7575201C0742B1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324557, "uuid": "4349d1a5-b6a4-4dd8-86e0-bc3ad3685dba", "value": "48:9fCzOw9c8EWVRz+Vxe799V7TsQl+AQj7M:W9cHa+a7NIQl+AQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324557, "uuid": "27af5a16-d3e1-47b8-815d-e299d452dce4", "value": 1551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324557, "uuid": "61b9ea58-675f-46cf-9ad4-ff7952f59165", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324557, "uuid": "edec00c6-8940-4b17-bae7-a4f4e79a585d", "value": "photov_027938430949.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64d0c50-8b8c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785357162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357162, "uuid": "486f6190-b9fc-4efb-9257-5e7c736974b1", "comment": "Malware payload (Mirai)", "value": "4bfe958cf0059d28cca18c596506078d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357162, "uuid": "5af8e477-7c33-4f0a-bc9d-24f6af28219e", "comment": "Malware payload (Mirai)", "value": "66116ac63292be96cc8a20fb991844fa378c19051a156f1c4dffb7db01b43dc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357162, "uuid": "4b57f77b-8218-4b2e-b310-6b708c56f49a", "comment": "Malware payload (Mirai)", "value": "34d47f59fff7c7878bb9c1ace26a93bb7cf23bef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357162, "uuid": "331098fc-e9e5-46a3-81ce-66e2534568d7", "comment": "Malware payload (Mirai)", "value": "52ca93781f0fc813132f54df1a411668b22d202c317913540f1ccae674570cfc3ce42a6a39206eb285bb5fa9b09935bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357162, "uuid": "6ed70216-f242-4638-90ae-222fbb8c7087", "value": "T1B783175AB9419F05D0D526BAFF0E534A33536BB8E3EE7102EE142B2527CA91F0F3A401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357162, "uuid": "019219ed-68bf-46fd-a61c-9dd1c2b676bc", "value": "1536:0FnF1YeTQ5SEnBGfBC46fvNWsD/Ry3dV2WqWNp02wdl1lieWVj57PI:a1YqrEBbvws7REdV2WqWNBYtWVjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785357162, "uuid": "0b0d0b10-1779-43aa-8cd3-56225cbd2e49", "value": 81048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785357162, "uuid": "8d44115c-7c3a-4890-8b8d-10ffe212da48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357162, "uuid": "e7d3a11e-66a4-4585-b2d7-f3ea2927f713", "value": "HjEG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4fdaa81-8b1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785309164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309164, "uuid": "18d1e22e-10a8-4830-8838-110844d0eec5", "comment": "Malware payload (Mirai)", "value": "32b267b07a45ce5e3426b577aa3abf16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309164, "uuid": "035dbec8-6572-49c4-b6e2-08ee279d6aca", "comment": "Malware payload (Mirai)", "value": "663606a57b1f38da90136e9a8c2808c860e12a86d06e65231c104d7d44727a46", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309164, "uuid": "55966049-4799-4742-8136-db1222bc34ec", "comment": "Malware payload (Mirai)", "value": "6c545df6fc5769453b581c2dd27f211c0ab4d0a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309164, "uuid": "d7308db5-2982-4aeb-9ade-9b1073abf9e8", "comment": "Malware payload (Mirai)", "value": "477666067fcfe35dec6dad8b52076028f5eb56a9aec96668c6994621c5b4fe2e4284cf332e66cc219a712ce23118a37f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309164, "uuid": "f690029c-1b14-492a-bbae-46593359e5ff", "value": "T1B4432A85B8829613C5D412B6FF1E42CD372713A8D1EE73079E256F60378792B0E7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309164, "uuid": "2f2c1902-4b99-4cab-b745-a24b8090c08d", "value": "768:tl2ZJOHZKJQDfyAKYpZ1zfkObb/NxAyG/OzjnBehZg4qvMdDuwztW3jVJdvaI:r2ZJ2fyA1LkObbLG/O36GWdXtWTHdva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785309164, "uuid": "5e8ef072-76b1-42a8-b77a-ddfe4758aa6a", "value": 56688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785309164, "uuid": "2dff8b59-b856-45a0-ab31-f1cb2bbcb92c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309164, "uuid": "935c3991-b5e6-410a-a549-5b469dd71a99", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df94ef06-8b17-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307007, "uuid": "1179a9b7-8f84-4471-b95b-204f229740f0", "comment": "Malware payload", "value": "755e13d167d752fd039c839e6ab0fd92", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307007, "uuid": "e9af723f-0491-4ce7-a7fa-5de8a1d00428", "comment": "Malware payload", "value": "667857e8cc7eb4db2280f1ad08066284a6f18c017aee3f039c8b7e811ed95aeb", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307007, "uuid": "02678285-07f9-4108-8597-3c2084a9c474", "comment": "Malware payload", "value": "4db0d0c16dff7fd7e475f33dff64835d1dac04b3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307007, "uuid": "9e5638bb-cf7d-4248-ac0f-c472a3bfb92e", "comment": "Malware payload", "value": "5736eb4cc8f5168f71a752c9ec40bb4845207752dc35ccce3325308cb4622801f4fb7878de7400f7227a226f209f113c", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307007, "uuid": "f784643a-d6f4-417b-8bb9-5f652f162c3c", "value": "T1F116AF16B7D40995D46BCB34CA2FD722C2F2B8760735C38B1A66270A5E73B924F3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307007, "uuid": "7cd73d1d-0074-4b85-9a87-bf49ff8d1f53", "value": "6568c79245e4d4346739df553a990fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307007, "uuid": "e4f40a63-1df6-4ce0-b2a2-ef0b451a948b", "value": "98304:QTM+yCvLTf0LJMufV6Qafo00sr13jcQr2KwtMD68Zrp+KxGLI:gfvLz05N6Y00w1IwZ1XEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307007, "uuid": "c48119b1-afd1-4f68-b106-1fc7f62f1802", "value": 4232192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307007, "uuid": "b38e91dc-de1c-43cf-8ca0-b7bebfe8664d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307007, "uuid": "3ce31146-23a3-492e-b30b-7586a11a5b3c", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbc878f-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307323, "uuid": "9116f18b-2c59-4209-ae13-02ddf5cf83da", "comment": "Malware payload", "value": "a58d45e91edf736a609d624e6dc47367", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307323, "uuid": "12a65c17-acec-4453-8ca8-e17c4e110c96", "comment": "Malware payload", "value": "668f13b711898600912e5e2e7cb8a076eac2b6ea526386c70c1de5a50f9f705c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307323, "uuid": "c7c350d4-ea63-46e3-8c9a-12153710f158", "comment": "Malware payload", "value": "43b97a3ba6c3454ecf4b0b1064274fb2a10a6786", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307323, "uuid": "32938470-8345-46ae-8a86-1b7527c081de", "comment": "Malware payload", "value": "1fae4e42a68576082a12e109e49c8077c744ab2cc9a80b10083c4458f8c11d8e6784b8562f6cc9c0eea00b2e0e35af9c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307323, "uuid": "251c033c-19c9-418a-86b3-bf8c6f6858b1", "value": "T17422BF3BFC19FDB6DDD997633A84275E20CD9F83A798EA4B2D0E102414868660E24C79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307323, "uuid": "a249337d-85bd-4ca9-9b03-0c3078988362", "value": "192:xDHcXCI3KVJF0VXn+MrtxeS8o7LKgW8sSld6W/KelDbUO36Gea3mby:h8XCI6rKV+8Eo72Sryc/N/ea2by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307323, "uuid": "2cfbe514-00d0-4878-89e9-d33cbde95ae8", "value": 10573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307323, "uuid": "ba4d1893-5752-42c9-850c-2c1dd5b076b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307323, "uuid": "773d62e5-537b-4f1f-ad4a-bb8a853e4b50", "value": "images_20260728_200836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95daea80-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352840, "uuid": "385e493d-c43e-4d11-841b-782296fb0d3f", "comment": "Malware payload (Mirai)", "value": "9939d74c60037938ef085b7dba70269a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352840, "uuid": "7e42beb2-801f-48b7-b34d-0bde1420f18f", "comment": "Malware payload (Mirai)", "value": "67f3574076af6c924ace8cd5352e99b7d9c756e7ef72ee356acdae0250f22307", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352840, "uuid": "d8afb29e-e4d0-4f44-a82f-3b2418a75652", "comment": "Malware payload (Mirai)", "value": "ce23d55556723aa6db15796afc136ce659f2cd9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352840, "uuid": "d450661d-a7fe-409b-b837-c2183245ee7b", "comment": "Malware payload (Mirai)", "value": "5319ba98232f2681fa96dd5cd7ed1316e16eec893842fe4ee63625f8029701768d1062843ae3ac81fd28c8d2807f06db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352840, "uuid": "bf76f174-c844-4abc-84b8-e5b02a414ca9", "value": "T1A504B81A6F228F7DF268C73047B74A35976D23D627E1D684E2ACC1142F6029E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352840, "uuid": "2262db86-d05b-4422-a21e-05a71de9359f", "value": "3072:Y1yIlu0jwI473wnTG28fa42MK98GAuuEbGXaxeVZizuJKlcF42D8:Y1yIlu0UATG2zMd7dmXePgwKlc+2D8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352840, "uuid": "36a6427e-07b4-4f7e-8031-98d7db7332e9", "value": 188696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352840, "uuid": "67a51c46-4881-4c5b-a946-8e4dfe234adb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352840, "uuid": "ec7cb6e1-ffb4-4473-b635-d84265f60cee", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d512dfca-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324599, "uuid": "9abda9f3-eb37-4285-bb66-f9b0ca0a1857", "comment": "Malware payload", "value": "187e736cf7b43284a7d566df269322b4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324599, "uuid": "1b3ad44d-e3f5-4075-9400-65fed30504a2", "comment": "Malware payload", "value": "680c8f5840e1711d77a5b13cd2f0901e4866f770ce2778110c48e39ad93c4cf4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324599, "uuid": "adbaaa8d-8780-463c-a4de-13ab588e3a53", "comment": "Malware payload", "value": "b178418da67f0419ac82acea9ca5be229296a62b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324599, "uuid": "5b63c089-e14f-4cb9-9435-402123c56df8", "comment": "Malware payload", "value": "b3226c15f8b99deccc1d9802c2ac73a2e14ee75d8f78881d6f43a3771e64233d8fcc5d21f0f5fabe32d0ce6b2d2ec4de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324599, "uuid": "c50fda69-c74a-404d-9fc1-204763b683de", "value": "T11F21C82488C984C9D1EF663434594B5F0714695599045AC6DBAAE805344B9C2F70BCE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324599, "uuid": "a3b09587-c577-4e5f-a41d-25f6f6929093", "value": "24:9m6GL6J5fzR/Tat7GWe8P2FQVr4ZmknetubjeYleqGZlNwX:9CCNzFTMqEP8QV8ZTneIbp3OwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324599, "uuid": "aa789d55-a39f-44a4-aed6-4f60326ecd06", "value": 1307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324599, "uuid": "f34c063d-62eb-4333-a63c-fdb04b77f831", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324599, "uuid": "ec6da70e-fdf0-46a3-9953-95689f68e482", "value": "photov_501789132308.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b4b4bc4-8b35-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785319778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319778, "uuid": "d02f3c17-a9f6-47a6-b88d-7871e65b742b", "comment": "Malware payload", "value": "791e450f020f6858d312df484f43f8d4", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA488", "colour": "#8BFFB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319778, "uuid": "7b3e2bf9-828e-4992-a401-81e3f066d5ea", "comment": "Malware payload", "value": "6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA488", "colour": "#8BFFB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319778, "uuid": "dda0c447-aac7-4df5-afbf-3e3283247b79", "comment": "Malware payload", "value": "1c9f9dab1879fc5f0269d499ff8d7d405132cb36", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA488", "colour": "#8BFFB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319778, "uuid": "69dbc0cf-018a-46a8-b5a9-e1b9bc9ba091", "comment": "Malware payload", "value": "47aa8a5020ef6bc0eb46014f65ab15de904b97834e699db366827e33c32d0c9da97c6912f2685c47b68f04a45fbabc1d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "TA488", "colour": "#8BFFB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319778, "uuid": "d7965e52-f7fb-4cdf-b6dd-7c9d7ee16291", "value": "T132638EAEC39237E9D72D174599D95C87332F1CCA242008448AEB4CCD9B2EDA75D792DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319778, "uuid": "083484cb-844a-4a71-aab9-142ab9560528", "value": "1536:WBbLAdxjmHKRqp6UF7n6fJXUXwpnlLHZW5:cbLAriHljYW8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785319778, "uuid": "428e341b-a51e-4db0-a7e1-312862bc3a03", "value": 68829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785319778, "uuid": "78cb3b27-81bf-4189-adaa-218580dafd7f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319778, "uuid": "d76358d9-3910-4463-948a-e415a660a877", "value": "ta488.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa29d708-8b43-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785325950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325950, "uuid": "fbf761e1-3a8b-4b9e-8e37-8e1452ad79fa", "comment": "Malware payload (Efimer)", "value": "48b105ad27033c679bb3db5703531ccf", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325950, "uuid": "b2c59ef5-6870-4268-853b-2c6233ea7713", "comment": "Malware payload (Efimer)", "value": "691b0e2f9555f229e921b0679f72452fe66c0d2432156efa4ff18c3f3724066a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325950, "uuid": "45ab7dc4-f929-4357-a252-4287bab78922", "comment": "Malware payload (Efimer)", "value": "7d755d05b63e1ba7401ba969a8463e897fe8fd49", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325950, "uuid": "2008bdc3-6e6e-43ff-95ef-5eb7756154ec", "comment": "Malware payload (Efimer)", "value": "df77fc1ed4aafb0203b1b1331cfd1e9fe7eb225bac7bf6ebc3950c2caf1d7caefac8f334ff44eaa50f5d396c6f2b749f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325950, "uuid": "d05e7050-73ec-4035-ba7d-6692672cc4f0", "value": "T13DE63354B6D112EAE993C23DAEE3A248D1B978771730DACB13B4D6627D831F08C35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325950, "uuid": "54b0d4a5-b94a-4b71-9e10-a3e6bde97923", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325950, "uuid": "3060bf5b-c5a6-4801-b1b4-5de7bd0deb37", "value": "393216:DSTpbclElh/mvwB+oBdZuXFbyXMCHWUjXUcuI3/PGTAI:DST5cEh/mu+2ZwxyXMb8XBH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785325950, "uuid": "500cca5d-094f-4f5a-994b-4270cceebf2e", "value": 14314166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785325950, "uuid": "59fe3e2a-93fe-4b93-988a-d883be9673ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325950, "uuid": "b5acb657-0350-4efa-8f0f-f7e75d145d6f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cf1aed-8b51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785331813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331813, "uuid": "683e8b00-0092-4bb9-bed1-b713e2050d43", "comment": "Malware payload", "value": "301e927cd4b68262f1c3f8f29f2c4586", "object_relation": "md5", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331813, "uuid": "e3c6332b-7f32-4bb9-87da-fb42149c7a39", "comment": "Malware payload", "value": "696329a31289fd29b81a5fcaeedec83bea3cd21aa9a721ae50650a6a1ac6c00e", "object_relation": "sha256", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331813, "uuid": "6d71c427-b688-4657-b572-c2c8c046139a", "comment": "Malware payload", "value": "d5f1d65724042f5c6e86c6309418efc041d3e1ab", "object_relation": "sha1", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331813, "uuid": "e04ec184-f0e3-4dc2-8a32-bcfa0f0ff9d9", "comment": "Malware payload", "value": "acf82ea3125d78b0be56c0e49696e0dca57f40c6c237bd16f3e2afd16e26f52aca587b794ac5ad1057c9526b17b91d3b", "object_relation": "sha3-384", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331813, "uuid": "b5c0acb9-766d-4c56-8c4c-86aced9a12b4", "value": "T14227824E36028017EDA62737C5F28252AC77AD304719C4DE35907E9A5E78EDF093D3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331813, "uuid": "9d22cf1b-19a0-46ba-b474-9dbee5fe0845", "value": "c38f93b50f6d7bb08c748685aa560407", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331813, "uuid": "b2e7251d-02a0-4816-b166-c04cdaf8f0a3", "value": "98304:d7BcFS5aiA65GTK3/cAjp/hdePFPZxjIJrM0ZdgGoG2cPK85gBvlAdL:7cFSIAj9hgYJ40ZdeCKs6adL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785331813, "uuid": "0e3d98b4-9606-40e6-bae1-df1adfa5770c", "value": 20386816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785331813, "uuid": "2554b1bc-21d4-45ae-b7e8-88580f233844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331813, "uuid": "88551413-3a48-4853-a062-81b85830fb3d", "value": "696329a31289fd29b81a5fcaeedec83bea3cd21aa9a721ae50650a6a1ac6c00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4725704-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324544, "uuid": "5d266173-ba13-46b8-a656-3b9905951544", "comment": "Malware payload", "value": "671fd52305f923899894d24a194ff95c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324544, "uuid": "ad4e1170-0944-4684-acc2-513fb86175de", "comment": "Malware payload", "value": "6a075178d97e5a5d954a4371c4411b5b869e9693f3b1885e99ccec118ff97f51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324544, "uuid": "47307e2e-2d20-4210-b6ee-9e6a99071a00", "comment": "Malware payload", "value": "685abb6090a6e72e403e1ce838879ee1223d5056", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324544, "uuid": "02cf5214-9235-4d2a-a6c2-ea74d220e227", "comment": "Malware payload", "value": "d2b0e8b5181e8f541e2d7f015c9094349ecb7a4523d620b8a42758424b00c70cc7fddeb88695cabb3df5a4316ce869d6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324544, "uuid": "88ba21a3-d319-4f05-b8b1-83162bdbe2fd", "value": "T1BF21890094428B70DE57ED36F8299485A94B8362171174D31F35B3922ACF4219F2B8ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324544, "uuid": "113808a5-27d5-428d-84b2-5e9da0a0a2d1", "value": "24:9suBpoJ4mjvefoA12WvQuZpxVLBNAOjKspLumkf2+UaNuUamyHLTsG0c:9sCq4wmfoA1rvZpLbLuTu+UkOB3l0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324544, "uuid": "e8bfcde9-d1e4-454a-9593-2bff3dea8fb0", "value": 1424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324544, "uuid": "c2ded1d3-a3d8-438d-9156-caf8290b62a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324544, "uuid": "7c6bc797-ec01-4669-aa44-96a3468b47a3", "value": "photov_605234264245.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d90ce31-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785349819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349819, "uuid": "a7f2bb04-1d9e-42a7-9353-044e19f1828a", "comment": "Malware payload", "value": "65b95f7e7e66b3059a756c4913c2fc9b", "object_relation": "md5", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349819, "uuid": "d310c1f9-af60-4b7c-8e04-6d8335f71ce8", "comment": "Malware payload", "value": "6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891", "object_relation": "sha256", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349819, "uuid": "11195795-06fb-40d4-91ff-cf9818066cb7", "comment": "Malware payload", "value": "8e022ce33e80a2e22b05790c1c13748b3c4bd99b", "object_relation": "sha1", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349819, "uuid": "ee2bb1d0-4490-4c15-b28a-17fda6f506e5", "comment": "Malware payload", "value": "92dad768284c426bf8baa756f9951959de4c2e08d111cb8414222c69bb50a5b5adf34f1a3d3d16644e2c57486b0f3dba", "object_relation": "sha3-384", "Tag": [ { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349819, "uuid": "5f542073-91a0-489d-a09b-20132cbf68ab", "value": "T1143140CE05142A391312CBDE73B23548B44CC3F76D6BC7959C490EED82498CDB17ABAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349819, "uuid": "d1b46fa3-041e-4de7-b9b0-4303c05867fa", "value": "24:r/RJLJDZGRpLSXbD+AkM6keUke55XzlJVG1NiD1R/5K2um6:fLJYLSRkM6keUke5ZzlzMihR/5K/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349819, "uuid": "83e114e3-a6cb-4cd1-9173-323382e3af31", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349819, "uuid": "3e178864-9aa2-476c-8f40-c95ea2b3e725", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349819, "uuid": "b67f9384-4788-43b5-9530-c4b40f73230f", "value": "6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e08ebd-8b28-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785314296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314296, "uuid": "eecd7791-f22b-4bbf-bd46-b6eb72bed73d", "comment": "Malware payload (Formbook)", "value": "e7f384be12a0e6c8e795993e757c4ec9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314296, "uuid": "6e653276-d627-4ee9-853a-1afd961bee4a", "comment": "Malware payload (Formbook)", "value": "6a2ba34451531f67b1fda9e5f46fc827a9af9944c348da0d81bc2e3a2b1195b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314296, "uuid": "06ca74fb-2427-40fc-834c-5707c4f31456", "comment": "Malware payload (Formbook)", "value": "9e18ca61ae4a00cbfac8a20a270b8a635056994a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314296, "uuid": "d7ae598d-80c0-4661-8856-5a2183817111", "comment": "Malware payload (Formbook)", "value": "0ba71d71d3eb05450bf73d82decab34460755522932dc4bd51770e1293d12732acef35f1d70087633c63ca18a64bce55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314296, "uuid": "1d453cd0-cb70-4cd7-8d68-892c004772ed", "value": "T1DC25221A26C58B11E4BA1BF41277E17453712CEEEA31C20D9FD92CFBBA13B64182475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314296, "uuid": "3bcbcba8-66a0-426c-ae37-1867aa51dc00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314296, "uuid": "bc05c59b-e791-47c6-b26f-52a09326af23", "value": "24576:hcotInpfCgoL5Y7CDkAaBw+iCSG5mZqeK+zaZ:uLodkcaBwlCSG5yDK+zaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785314296, "uuid": "377d0af0-c7ea-458a-83c7-d839d16c8838", "value": 1030656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785314296, "uuid": "ca5cb33e-875a-4e4c-bcb0-b81e5325ff36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314296, "uuid": "7e312ba1-801b-4d3c-8bb1-783836deaafc", "value": "SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e708a17-8b8a-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785356129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356129, "uuid": "3571efa3-4463-43d4-a11a-0e453e1a41f1", "comment": "Malware payload (WannaCry)", "value": "609a433ec177c59a2667d9e29a15e17e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356129, "uuid": "38c31f30-b113-4993-ade4-3357272ecc85", "comment": "Malware payload (WannaCry)", "value": "6a4d371a7e82215799f79944204cf1ae4586a5a1cb6bdd5f6fb55e811e2154f2", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356129, "uuid": "31f18062-42f8-48af-ab57-d8ec3952448d", "comment": "Malware payload (WannaCry)", "value": "a12df571520fe64a8847428e81d040176b8c6594", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356129, "uuid": "4f23266f-695a-459b-971b-de935f31eaf2", "comment": "Malware payload (WannaCry)", "value": "1c687278732e64a2f9a9593c82ffd6b39e690d2ad6b71e82008f06a44d1c42fa9b669216865b6606e8843f12cbdb594d", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356129, "uuid": "3a7371a3-b863-408c-9ccf-83407236ad87", "value": "T14A363398726C90FCE0450EB444B38D1AF7B37C5A67B64A1F4BC0877B0E53B9BAA94741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356129, "uuid": "e5e352f1-a019-4637-bb4e-40489faf492e", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356129, "uuid": "fdafbe34-260e-48ea-a0b1-ef21c6d3facd", "value": "98304:DI8cPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DI8cPe1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785356129, "uuid": "8398374f-d75a-4957-b73d-8b04663fc2ec", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785356129, "uuid": "fbb26bf7-0c69-45fb-8c65-ea316382c83b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356129, "uuid": "c058497c-10b3-4056-be7e-644b7e88b0d2", "value": "6a4d371a7e82215799f79944204cf1ae4586a5a1cb6bdd5f6fb55e811e2154f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a40215-8b2a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785314856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314856, "uuid": "4ef9ab86-06a1-4107-a4b5-5a24263df735", "comment": "Malware payload", "value": "9f0c2fd34d93ee345a265097d63e4366", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314856, "uuid": "e31a50b6-94d9-4a3c-8c83-62d23f243f99", "comment": "Malware payload", "value": "6a4d4cf66e35ceda60fbec8568fd9a56f879c7a89b81286f3d0c33be50da89b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314856, "uuid": "5ca57b20-7e7c-4ebb-a36d-ab288227c130", "comment": "Malware payload", "value": "b0eea2bd096519d2aedc036d21880908a1df88e6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314856, "uuid": "c62ac0a6-b2dc-4b77-9a5e-48ff41a46a44", "comment": "Malware payload", "value": "f000598a8652a6cf766a607f4a594e5205784293f53b2725794d894ee4ff15aac13f60c538dbcdff0289bf8d7678c13e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314856, "uuid": "251fdfe2-fe19-4a04-9ddd-2a7c6f861045", "value": "T1ABC27D956A86BC44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314856, "uuid": "dfd5e08e-1490-4919-8d14-1ccb94bb4146", "value": "768:X8vCB+25j6es8REF9FYpMSUpi+20qUpi+20YQX:X8l25JEjd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785314856, "uuid": "b48e1b1b-1053-4763-bfc8-aa1cf9634272", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785314856, "uuid": "b2f0411d-29c1-4ac1-a5ab-476fad9c63d0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314856, "uuid": "00725ff3-d673-480b-a0fc-2460b98fa22b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de06411-8b5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785336425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336425, "uuid": "1c661bac-04a5-4e9e-82dd-7f8fab03b0ec", "comment": "Malware payload (PhantomStealer)", "value": "279d2a252179bb4c98a9503c688da3e8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336425, "uuid": "f0a982ca-962b-4315-be86-d8dd6d35b2cd", "comment": "Malware payload (PhantomStealer)", "value": "6b278084f9905518c01eee7886de87ebfa888398f4eba2b7e1f0ec57117025cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336425, "uuid": "5e1be000-dd6e-4b99-9218-0c609d721500", "comment": "Malware payload (PhantomStealer)", "value": "ad3759dc801b82ebe860e458ffb8ea1252b3abe4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336425, "uuid": "4cd86f5d-ce76-4437-85ed-418de982ecb6", "comment": "Malware payload (PhantomStealer)", "value": "62793a03139fe423f08550f12cc6999fee060f0b3b3454737ce8511a0dec0a6766a56b7802c603fdb11e77d5b625ca4a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336425, "uuid": "9a9b04c0-6af6-4182-accf-34311e83cebb", "value": "T14D850AEB8FE096CDAAB433ED6E46C45C8A70252F64DBA17B743817D9BB110C640718BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336425, "uuid": "bc861982-173f-4a84-8778-a5c322d7022c", "value": "768:rt/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/t/v:mK9OwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336425, "uuid": "85b762e4-0e20-494b-9b5d-599bcdff2417", "value": 1793755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336425, "uuid": "8282badf-613b-4c9e-90a2-c0321fd82a11", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336425, "uuid": "c028829b-8c20-4eb4-8dc1-680123ad935a", "value": "fedex6087554534.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bc95c6-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785354524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354524, "uuid": "ee7e98c4-1cf9-490a-94be-75713c457e97", "comment": "Malware payload (Mirai)", "value": "f493aac6f5c916ae211fa607e46d03e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354524, "uuid": "ff42d3fe-e337-4568-b5f4-48f5b21afd19", "comment": "Malware payload (Mirai)", "value": "6bdedd8343999e8e0fce00858ee8fe47c1e42e27db2a217d4cdb689e048b5522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354524, "uuid": "631a42d9-1469-409d-80ba-e465aac03bd6", "comment": "Malware payload (Mirai)", "value": "f133283253256346357bb37bd9bd5dc8d9d4914c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354524, "uuid": "50c3610c-1063-4ccc-8788-7693a178185f", "comment": "Malware payload (Mirai)", "value": "c81fb92860764c77304a674c591ed528045bf6b259575e199e3bbe20eb30044906a565d1e7cb02c318ea061761ebd804", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354524, "uuid": "a79bdb10-a01e-4866-b18a-2f61b3acee42", "value": "T1BA631885FC915B2AC2C117BAB5BE668D3724A3F493CE3113EC214B253BC951F4936E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354524, "uuid": "746fdd3f-ea03-4ef2-a9ec-e3825ad9e412", "value": "1536:U+YC7svXl30oFPZWN6YNM+oZ0K1a10rb9EJ:U+YCwiE8N6YEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354524, "uuid": "967e0c92-bb76-46b4-9fc8-097a69345f54", "value": 72732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354524, "uuid": "39dec582-6928-4106-8f4c-472360dac892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354524, "uuid": "959071b5-3b32-4110-a620-6ea99bc83f44", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b51040-8ae3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785284610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284610, "uuid": "e96ef709-b5aa-45e0-bad2-9c6b2946c427", "comment": "Malware payload", "value": "c816233843df005e0e0d954f40b35397", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284610, "uuid": "b3907290-8e30-483f-895d-2ca6646365ab", "comment": "Malware payload", "value": "6c37739ac0fa9f67869f6c1ecdc939d5b05ad783b85d12f661c432f528ba7389", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284610, "uuid": "b974bcd6-a0aa-45fa-8a5b-23339c88007d", "comment": "Malware payload", "value": "d0399600174aa28bcdc83df1e7ce7e8efd3fba58", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284610, "uuid": "d6fb3844-85e4-4ecd-8b6d-ec729c587318", "comment": "Malware payload", "value": "7401ee16fe3674e9250f912a621f6a28fabc48a8955aff92bdca8d7eae5c1ec156c97d789698fcd6ce0e1f254b496414", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284610, "uuid": "271ee3b8-a23a-4b75-aba4-7197943c9ca6", "value": "T12601F69CA6BCCF921AADC589B6F49504449290C7E1F5ABD6F24E0C24BF44E4D796320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284610, "uuid": "37fa4ca0-0198-46d5-ae64-21e0310cb5eb", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkYBj0kGwnv:FzY8k1/sWi2jkE0kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785284610, "uuid": "6eb29eb7-1a26-481f-9c80-6cd4af2d5202", "value": 658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785284610, "uuid": "0554fee2-aa6c-4175-a184-2136898df3a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284610, "uuid": "b2b94ec0-3b99-43c9-bdef-975e4d439fb2", "value": "setting.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbd6b16-8b42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785325389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325389, "uuid": "aabac447-456f-4a6b-95f8-f182a6a5b56f", "comment": "Malware payload", "value": "258926ea3734ee5af2fb50340dd947e1", "object_relation": "md5", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325389, "uuid": "2bbd8b5c-9ccb-4449-951b-79102f1ad24e", "comment": "Malware payload", "value": "6c95b2b11729bd3b9076a0e5f08b578f1b07f3015a8dd99ae3a0dbb8a02b5b69", "object_relation": "sha256", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325389, "uuid": "657edfd6-2470-4369-a2f4-50104e365e80", "comment": "Malware payload", "value": "9374bb5625031dfdf41a95cf94991675bfee07bb", "object_relation": "sha1", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325389, "uuid": "341bac40-c322-48dd-aba3-81c4cd1d7072", "comment": "Malware payload", "value": "fc0c20f724f45c4dce8dd4174047bb3818cadf619ce5031abd3ab936c919e85a7255036ee81c7219e229e7cdef3316b0", "object_relation": "sha3-384", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325389, "uuid": "31d5572d-2751-4c0a-b2c6-74db92842ddd", "value": "T1586733866EE2DDDEC42BD07633F6962F27157B3E30C8E724A90495AB5B87A1F1404C1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325389, "uuid": "ac5047c4-c8ae-45c4-bd54-7e1474a19756", "value": "786432:cp5kI2FUQO+cFh6GMSwC2qjDs7zY2be/TvLa:AkdSSjC2qjDsLyTza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785325389, "uuid": "eee49761-31d2-431f-9efc-3571bfd63544", "value": 30163281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785325389, "uuid": "403cfc0e-e7a2-4412-b5d3-6678c11b8a27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325389, "uuid": "320e7862-1ead-4fc3-81e5-8c33a04a427a", "value": "3c2227bf19e1c955aa405ea712263567aa4b8398a04d299c0f1ac72a68d8b078.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cf2569-8b1d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785309373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309373, "uuid": "5e4e4bb1-26e6-4163-a507-81e3a43a702a", "comment": "Malware payload (Phorpiex)", "value": "64fb9c7d49dfdacc16fcdd80f89404d9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309373, "uuid": "c8b15ecf-2c40-4348-ba26-7c3f3a5447f1", "comment": "Malware payload (Phorpiex)", "value": "6d2790be771ec07b236ea618dc29e1b1364618521d6806483f0e515d99fde7d2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309373, "uuid": "9f2cc2b3-9fa9-4f80-9f7a-2b1097c14f07", "comment": "Malware payload (Phorpiex)", "value": "cd97ffbb0f27736fba498c8cff66a011bd06ab40", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309373, "uuid": "2a04c96b-d1b3-4f6f-8c30-d39f184dccef", "comment": "Malware payload (Phorpiex)", "value": "fee3e64f7d63d847b04a913b7f8cfabcfb644c5ca40fbce5cfbd2e45545a90bf7c6f78e081ad99d3c96025c13527cb29", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309373, "uuid": "88259601-6227-4241-9649-ff335c20c36b", "value": "T15B823B0FB8424316E1E110B4966696BBD9B9AC7673C414EBF7D44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309373, "uuid": "7a48b1c6-e1a8-4662-8b67-d77c79dadd56", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309373, "uuid": "eb6b71a6-aca8-4fdd-b20a-a8336a4fce98", "value": "384:AMZbmcmhzwEUaUu94gXTP+av8U9c+34P:w5UaF9Ka0U1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785309373, "uuid": "a42646ca-6a77-4d86-8237-b04e5237afc5", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785309373, "uuid": "3b5aee4d-0ced-4b97-af59-77f828b7482e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309373, "uuid": "84e159d0-d6d3-4313-9278-0cffdd82d73a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2ebb0d-8af1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785290572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290572, "uuid": "8281d16c-620b-4b9c-aab1-3b5354e3f2f1", "comment": "Malware payload (Mirai)", "value": "17cfec542adc8dadd3e2ddc86e209327", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290572, "uuid": "e0b371af-9f59-4b6a-8ed5-78603a390390", "comment": "Malware payload (Mirai)", "value": "6d785f191a10799f38e08cfc5563bd559729ec74efe2aa242c4542fd853f90d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290572, "uuid": "f08c5ca9-4729-45f2-8b09-ab4a47277cde", "comment": "Malware payload (Mirai)", "value": "a1e333da3fb3406aeef2588d00f219431fb6ffab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290572, "uuid": "4025bd43-76a9-44e3-b666-463e1b577478", "comment": "Malware payload (Mirai)", "value": "3f2d17b9225a319a1695987764dd0872b1eff94b943ce380c4379133baf776259cf90280fa2c5c2ce14492fc8bf10144", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290572, "uuid": "0fe24224-6e20-4534-88e9-865b72f529b4", "value": "T163F30845FC519B13C6C612BBFB6E428D372A17A8D3EE32039D215F61378A85B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290572, "uuid": "d9712571-c79e-4955-8f03-e6a4c8edd3b1", "value": "1536:9nG9tcj712jNwLGa3MRA+j4de2ozs4V/QHTDy2atbqE0kFGhz30lmdwyw+GrU+78:9ngONT3c8dem4uHfZaLw1/WPzrnq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785290572, "uuid": "18cf6696-124b-498e-a44e-d1b264b8e6da", "value": 169632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785290572, "uuid": "4dd7b3f5-b436-4730-a626-52eee1200843", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290572, "uuid": "eb49a624-4eb0-4898-9b47-a9b6a15d23c4", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe4797a6-8b00-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785297180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297180, "uuid": "7a608d6a-0b9d-4b4e-aada-f154d8a803e3", "comment": "Malware payload (Phorpiex)", "value": "8b69778d8b7effe9db3390ec715e37c0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297180, "uuid": "3ae3bc4c-7754-4a27-b3ae-b2465030438a", "comment": "Malware payload (Phorpiex)", "value": "6defc35bfc6f3e62dbe357f0f9b2063fbfadaf80574382a9c141d4897140a1a2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297180, "uuid": "96836c28-36ad-46b3-afb5-c1d63af78374", "comment": "Malware payload (Phorpiex)", "value": "9cfa070283a78fb92bce823ac34cdd91cb203ea0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297180, "uuid": "70b3de5f-1fd3-490d-8774-e56aacbb624b", "comment": "Malware payload (Phorpiex)", "value": "ec98680b7f5396cdc4a0c6f6d5635800bfe536ce7749fe70794705bbfab5e89d3ac76a85ebb6519f80c749896e83b854", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297180, "uuid": "78c09813-bf41-4d3a-99f5-afb6ce08041c", "value": "T196823B0FB8424216E1D110B4967596BFD9B99C7633C418DBFBD44AEE1A686C2FC3250F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297180, "uuid": "1f2b97c3-893a-4db2-b041-7e5cc634441f", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297180, "uuid": "a9940e28-f549-4151-b7fa-2af943473069", "value": "192:AWs6SkQzngjoWLsmBDTlIUqRQQPcleSMv9fKUSiu9zwfge+VOgbOOqmEd6FQv9PC:ArZbmsmBTQU0Vu94gXTPuav8U9c+A4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785297180, "uuid": "57c6e5c0-bf35-43a1-bb68-a3d0810c1897", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785297180, "uuid": "030331f5-7831-42ce-a990-377d95dbbede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297180, "uuid": "870b8f0d-add4-418a-b153-53ddac30a4ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cce851a-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351778, "uuid": "8b34ea79-029a-48e3-8c80-fe9c350f26df", "comment": "Malware payload (Mirai)", "value": "eb9827c99c6423d78393297cf5fca9f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351778, "uuid": "8900a758-cfe8-40fa-8661-9d52906a4c7a", "comment": "Malware payload (Mirai)", "value": "6ea50710c93686f003af4b988504499a27ecd8355b47642c9737dce630950865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351778, "uuid": "6dbd6bc5-78d0-43b3-a6f5-4caf5874c626", "comment": "Malware payload (Mirai)", "value": "eaa8fe3531cb5b1948ce61fc135d20a6736367c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351778, "uuid": "489cf011-3826-428b-92cb-8fcced57bb69", "comment": "Malware payload (Mirai)", "value": "cf828e789ab7615f979c5384d477afc6717e6ecb298d0ce36700985c2f81feeb3eecba690c638b0db24c1bb61e6b003d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351778, "uuid": "06bca4f1-a43c-4f3c-96bb-2566e3bd04c0", "value": "T1088302E3A572466FF3D513B708A2084F2D76917A2C2CC559B0A70A1F443D4CF9AF9E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351778, "uuid": "3c0976a5-d900-473d-8194-4d31268301dd", "value": "1536:aB/ccsAf+KnPnemRda2r5EuY5Bj8UV8er+XKjOahcSCvkpomKtAROjkeQF:ynsAf+cnJvaw5EuYqerPKYczSwAROju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351778, "uuid": "59aa6cbe-9b70-4172-a0d1-40923b8352ab", "value": 87840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351778, "uuid": "12a04b4f-449e-4a44-8d41-ad1071dabbb1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351778, "uuid": "b04c399b-28a4-4f47-9205-ba7bb31322f2", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92cc28f-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307426, "uuid": "9cf29ab1-418b-418d-9b0c-3617dd79fd23", "comment": "Malware payload", "value": "7ccaedf58011fcc06326ee80cbb3bea8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307426, "uuid": "24b97ad6-0cbc-4a83-bc6f-cd58fa4d4f92", "comment": "Malware payload", "value": "6eaf3db89f368d36700e9de77a53968169f441f42e14bda9ef8ae2ee40a5590c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307426, "uuid": "8de85779-f05c-46f3-9898-3011cf4be04b", "comment": "Malware payload", "value": "7d14aed3eb2ee2d5a59a0dd0880b5b24c957ea2c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307426, "uuid": "d988a0bb-5853-4516-8ccd-edd695f0e744", "comment": "Malware payload", "value": "7660dd8a472fedffcdd06a24df6b188624ed3f7a42f3adb78081d1ab93887004714fda00707d61a6929d94cadd6e1841", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307426, "uuid": "d281d4a1-f15a-40f9-b34d-34473742fff9", "value": "T19FA18E24A2F941288BBFD1F47CBBBDCA1B6A0A93A361054621D946FC0FC095F9735055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307426, "uuid": "b7250797-5335-4073-80d7-fbaa03a06c14", "value": "96:LHUGu9GqMMXpZJU8coG11E23kTSJmL9T+q1/bg4vq2894aItqUcEXxvVGm:oN9XpZJfIRkLj1jgL2aI/ckVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307426, "uuid": "b27ac86b-a214-4120-81f1-5e68ae428665", "value": 4864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307426, "uuid": "7d509db7-31e8-46f6-8982-b0cd64c64c34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307426, "uuid": "51c8b5a7-c85f-41dc-927f-ddfa5bdd978f", "value": "images_20260728_120011.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eed88a3-8b92-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1785359727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359727, "uuid": "b0e262c9-e8bb-4329-acd9-39f18e27a5b1", "comment": "Malware payload (WannaCry)", "value": "9ac564e1f6b5b1fb1fa22cf419566ef0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359727, "uuid": "5e96ee19-c2f6-4b39-9311-145d2155f175", "comment": "Malware payload (WannaCry)", "value": "6f65ac067cd914ac0d3a04d801e0363cf615f867c0fe683340656387e48f9337", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359727, "uuid": "4aa6c3b3-ecd1-4c76-ac22-6bb4466e16c0", "comment": "Malware payload (WannaCry)", "value": "286e08273c64ff646c4de582bccbbf8861ea28a2", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785359727, "uuid": "bf61bf0a-7f48-4979-bb60-954d71bd0b8d", "comment": "Malware payload (WannaCry)", "value": "180ca8b0442006beb793388429ec998c7d657ef0437090e8fc1ef6b6af912ea92e71a44fcce4372ae9d9915f3ab1db5a", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359727, "uuid": "30453576-2179-464c-8e8e-9987cdbc3ba6", "value": "T18006239932AC81FCD1171670D0B78E25F273BC6E12BA470F97508A392E53B81BB64B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359727, "uuid": "9a60f801-2200-42b2-8fca-1ec4a00ab712", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359727, "uuid": "e61ca903-e73e-49be-a6d7-b5f1ca464c2f", "value": "24576:jbLgBbLgurihdmMSirYbcMNgef0DHzoAdNLTSk+RdhAdmv:jnsnnMSPbcBVD3N3ARdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785359727, "uuid": "b89bbce2-a0f6-4db6-ae35-c919d063d171", "value": 3663872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785359727, "uuid": "03108b8c-5f5a-4b14-bad2-7022ffd149cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785359727, "uuid": "3ed15fa4-8969-49cb-98fd-a9b2cfd52e3f", "value": "6f65ac067cd914ac0d3a04d801e0363cf615f867c0fe683340656387e48f9337", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c24c14-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785352358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352358, "uuid": "84a58940-af41-4502-be6d-fe2993b6748d", "comment": "Malware payload", "value": "8318f43f7ed91d04a5359a5f96fa533d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352358, "uuid": "d5ae1368-d957-4fa0-a4a9-b94fc14fb574", "comment": "Malware payload", "value": "6f65c49d2057a600e59c26b8ca003a17c2f312e3ecc269b8c69a6c0ad24dae19", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352358, "uuid": "d170f007-ed7c-4805-8454-ef63b499e424", "comment": "Malware payload", "value": "42ed356d5aeefc5c8a2beb8d3657e2600cff5ea9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352358, "uuid": "62daa643-1f67-48a5-9f61-ec5711819b0f", "comment": "Malware payload", "value": "cd7ae035a93380bb10efc832174a4845211b45ebc28369dbec07be5de6d74aa7cabefc2c87f5e00b065b60c6d8e01937", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352358, "uuid": "54f23485-7b4d-4cf5-bcf0-b9ed148c41e2", "value": "T1C0236C6516857C14AA99C4365C7E2F0CBDAD43E6314492EE7FCF3CF28C4A6ADA20871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352358, "uuid": "fae70aa9-71ca-4be7-9cae-da9d91eefd71", "value": "768:4r9NyXsZztC79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:mHusZdcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352358, "uuid": "aa701e25-554d-44b7-bb70-ea065967228a", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352358, "uuid": "2a7525c4-19be-4fdd-a116-8789396be9e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352358, "uuid": "9b2d02c4-2989-498d-acdb-fc484dc08a10", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fcd148c-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320993, "uuid": "076eb3ca-7caf-43e7-88cb-ec2a5d9d8cb6", "comment": "Malware payload (Stealc)", "value": "40d291a45b171ed64df46347ff3aecd1", "object_relation": "md5", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320993, "uuid": "1962debe-e3af-487b-9e3c-edc0a727b355", "comment": "Malware payload (Stealc)", "value": "7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413", "object_relation": "sha256", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320993, "uuid": "c17aded7-225c-4d96-93db-d3ca21c37d97", "comment": "Malware payload (Stealc)", "value": "5a444dc300e998eb0a4534935155f6a78e3517ca", "object_relation": "sha1", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320993, "uuid": "83ab9b4f-55bf-4e28-b376-ea5e6122e1ea", "comment": "Malware payload (Stealc)", "value": "ca9d625420ca6137bf382be93f914925661cbb62100de1c774d68d1c70248c0f3e0255e4030558f1aa128ed6c6ad1216", "object_relation": "sha3-384", "Tag": [ { "name": "43-228-157-66", "colour": "#4A7679", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320993, "uuid": "45992c13-45eb-491c-b7f2-2ade7420acd1", "value": "T1FB95330352D851E2E8785B75A8AB46479B7038B29F7C75DF7185E68E0E230E29337723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320993, "uuid": "86b81e25-ed22-4f89-af84-7c4bf0dde280", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320993, "uuid": "76d9e2ec-1419-4292-873b-ea8cdfbc3a57", "value": "49152:k+0ZuCfEgroyt7NMujuLcUgBDkquzYUJKEf5cdpnMihG:k+0ZYgroU7juViDkdYelqdp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320993, "uuid": "c5ada37f-fde7-4fb6-ab21-04fc3ee16c57", "value": 2025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320993, "uuid": "b4563a41-fbe9-4f1b-b4f5-95908c3b3fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320993, "uuid": "138b61ae-8f1c-47d8-a250-f56f4b026a75", "value": "7072509bfed6050e7f498f78adbb2fa8dd6b3ffb5ac71c2a3dff942bd484b413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f4a9a9-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324574, "uuid": "498453af-8438-4b07-adb9-1d98896e7bef", "comment": "Malware payload", "value": "be22b78d684da1213589abeaff731293", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324574, "uuid": "42d779d8-a898-4626-87ac-a620f16bb849", "comment": "Malware payload", "value": "70834d14952834148288f1cf93edbac7eeb8a62cb90fb312c8e3091b1e14cb89", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324574, "uuid": "f1b48051-6970-426f-b3dc-741695359724", "comment": "Malware payload", "value": "68d939c0e443e4efc600feee6d2dba780197ee04", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324574, "uuid": "8f2447b7-cb02-450b-8de4-37b9e1fd2f63", "comment": "Malware payload", "value": "0eeb32a4d14dcd1db09ddfecee7a04c40db66dbcefd5f3a644e0a52b6cac912284e48cd4c73d612881eb54f02cd27333", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324574, "uuid": "051b6703-596d-48e0-ab19-163c1862cffc", "value": "T18E31B964826F826AC8C52EBD7EE61344646D3195428490EF63D724A21A74F693FC7CA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324574, "uuid": "584b09ce-cb30-4d09-aecc-d432ac15d412", "value": "24:9mGYloXHi9OWk1eoT712udYrVG9yrxNBbdWFMHmkQ+XX1/5cpeYWDwb6L6KbGpX:9fQoXHmjoT5/dYrjfdWF+T/XHcpeYWEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324574, "uuid": "7c813449-8071-403d-b452-189268098021", "value": 1468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324574, "uuid": "071abaeb-daed-48cc-82b4-920bcbc4fdac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324574, "uuid": "3ff7d96e-bbec-4842-acad-0eae1ebaaa8a", "value": "photov_666120654596.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63b7114-8b3e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785323661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323661, "uuid": "8e6f57a4-66fe-4a65-a829-9cce8f9c31b6", "comment": "Malware payload", "value": "a19f94eeb0e06b5275e3024dba51dca1", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323661, "uuid": "ae583a88-29d6-4789-b727-39b069516d72", "comment": "Malware payload", "value": "710326f27c8dbd58d83c386dbbdc5c807cbc7f31ef07ad74d08d785419dc5c9a", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323661, "uuid": "15584af2-f78f-468e-9b30-7fb73c1393ee", "comment": "Malware payload", "value": "602b1b3ae58bec9361f837a6c160fa41338474d3", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323661, "uuid": "bdc267b7-e848-4549-8a4a-3219532c01d3", "comment": "Malware payload", "value": "2c57a4c950ca8211de0a20ff304d787f9369a03222b5d6d79ed6469e8014c868be8289ebffeb4a4160afe6827eccca08", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323661, "uuid": "ef633242-8b63-4454-a307-afab6aa89f9d", "value": "T19F263386D29610A5F87F243089DC3EA1D3B610B7EDC311F755910A9694E3A85F73FE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323661, "uuid": "398414e0-212b-401e-9ac4-b0b00511dc2a", "value": "98304:szYK0aBfy4p7O3vV//gE6lFh1YoSxtRlPvEVspxZjKLXrg18sb7bEU8oD7:szLj7O3vD6Dh1Y1tRl3EV+xZjKL72lbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323661, "uuid": "71028ddd-8f8b-4fe8-b18c-e9242025295a", "value": 4825029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323661, "uuid": "83c63604-133c-4d7f-955b-30672ca8a7cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323661, "uuid": "b3e4cf27-c4cc-45ea-81b4-ef71300e17ac", "value": "Psl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c2eb024-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333093, "uuid": "ee8eb215-db1c-4609-bbb3-b8f528bf5f9d", "comment": "Malware payload (Mirai)", "value": "29e3242c7a200813bfd9ecd96daa2162", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333093, "uuid": "a5df028c-95b2-4ed2-9e50-0fe1c5d8f4a7", "comment": "Malware payload (Mirai)", "value": "7145715cdc4352efd192a1d0441180f25cb274f2602845f0ddcb60a1c5337437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333093, "uuid": "235e9d18-48f1-4c7f-99b4-6e824535ebe1", "comment": "Malware payload (Mirai)", "value": "57796d216a54a0af86863c5b26503cb87dc4935c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333093, "uuid": "344a16b3-6772-4c87-ae7e-2c65055837bc", "comment": "Malware payload (Mirai)", "value": "c0847ad31c2de86bfc12f1227d22ecf1a699443a03a2f9c6633d1c75660579b3df773c1f4a4b7aecf17a1ddf67cc12c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333093, "uuid": "c018a824-ca15-476d-a9d0-b7c947820293", "value": "T1B4257C1EB2B3F17CD00BC03457DBCAA25531B47526313DBB26C4DA352EA6CE12369B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333093, "uuid": "bff9a238-c5d2-4fbb-a031-f856868f2cea", "value": "12288:y2G1u0wlRAEMmNY7dRHywNg5ioRpC5mW/Q2qxavd5QamwTRayDedHX:4UTxMmNANg8oXAmafqxqeamwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333093, "uuid": "c22c233f-233a-438c-b783-9dc108375c6f", "value": 968880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333093, "uuid": "fa045e0e-ea1c-49c2-96d9-a3e2d7785606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333093, "uuid": "a76dca47-1865-47c1-8056-1896398e84bd", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df71baa1-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324616, "uuid": "7dccd5c5-a38c-4d64-8499-2b93e0e2c398", "comment": "Malware payload", "value": "7f42dd3d5ea8ca52318c71971e7c0c95", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324616, "uuid": "979921c6-7a6f-4394-ae41-c0781036c6a7", "comment": "Malware payload", "value": "71597d1d3fd474edc6cd032cef4453784b0f9e0952ec5a086006e391922f59a9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324616, "uuid": "cf3d7227-7341-451d-a8f6-e1635db685e1", "comment": "Malware payload", "value": "cf19a119bab531b7c3110f7f0b5c3812870641df", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324616, "uuid": "80d630f8-0fe6-47ce-9275-a4728df65100", "comment": "Malware payload", "value": "ebd6c9bc934283e8651e25b509b71a38e96936fdc0a47d1ab7f8eec7921242989c24758a63b4f96dc6378e7fd7d6fdb9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324616, "uuid": "296ef387-d572-4950-a694-75a83337c8e0", "value": "T17921A5AE866CC2E7FEAF49B82D440B095434A5B11643825F2F12F21F7A23710C7412F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324616, "uuid": "06f2fbff-7306-427d-bb52-2b2494d22490", "value": "24:9WXCFvbpCTIprU/JIrH9rmkGxbW3sW8xrSxs/WZCgI3q9mS:9WK0Q9rTGM1urws2kq9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324616, "uuid": "c8e42cd5-5619-4ede-bd23-e8f6eb6a7476", "value": 1344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324616, "uuid": "9776030b-f5f1-4d3d-83d9-0ce28f610345", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324616, "uuid": "4b140e7e-5331-4e60-81f1-40439f05b9d2", "value": "photov_929178069480.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a4cf37-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307469, "uuid": "c219bdf4-6133-4d48-b170-26664f7a2d08", "comment": "Malware payload", "value": "14a56e455843cb8a17863cde95b595ff", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307469, "uuid": "98640140-dce3-4e0d-ae38-2065f8652479", "comment": "Malware payload", "value": "719ebb65c1ddac3e2e0537b60f0ea69107916dd7c6ac086d627363bbe7778537", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307469, "uuid": "5ea5695d-4dee-4ee8-a355-c48c9d9ad7b6", "comment": "Malware payload", "value": "f910cc0524b09777558c9db404529a13d38b1be9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307469, "uuid": "99479c8e-9106-407c-add1-7b137e553571", "comment": "Malware payload", "value": "25c0692cd6d124c82fcbd29782b4c488280fbaf1f9b98778b9c8c7322776b5fbadf86c3a91b63ddf15cc60e89b82e64b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307469, "uuid": "315aae5c-59e5-45f6-9037-d8470bf0dbd5", "value": "T13031A77A543E4491D3D1F17266B696AB951FD5C842166D40728C44962CE49F707C214F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307469, "uuid": "dd799aed-80c5-4c2f-bd50-4f71f2cec6a8", "value": "24:93OLfc6gQMmyZIy4dnfJE2ING9pcPyabmHFW7uVvofd5e8KspbD2t7UEN:93F6dMrZI1fJCNG96PyImyuBIs8/7EN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307469, "uuid": "6c8f92b5-94e3-4b79-841d-2c4e495b9b36", "value": 1497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307469, "uuid": "bd19868e-5465-4b24-8ecb-6e3cef97b14e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307469, "uuid": "589b042c-5091-4231-b763-6f0f0e443ae6", "value": "images_20260728_084524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff4435f-8b7e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351031, "uuid": "aed5ec82-74bd-4624-87cc-fd6409a12414", "comment": "Malware payload (Mirai)", "value": "c20df51da8ff6fafb4dcd6228dcf9eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351031, "uuid": "bb77f926-9977-41a1-8acd-328ec412dc61", "comment": "Malware payload (Mirai)", "value": "71a38bb78c3aeac3135d4f55aa1f4c4d54fa130fdef0a1a360d33d0f608a8f05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351031, "uuid": "459ae78f-2c05-455a-8626-f20d4b92e0a7", "comment": "Malware payload (Mirai)", "value": "f66224076ff299675cf86178e0db09b4950ec19d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351031, "uuid": "2ce2ef57-c9a8-4e5d-957b-5a62e22fff4d", "comment": "Malware payload (Mirai)", "value": "f02d208aafbc8328deb3ee7a99256502bd1b3306805080b2e8c7f11eabe00e853760d8c4fd78c3f56abbb375b2f09e1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351031, "uuid": "a2bd0eb9-8cb3-4264-88fd-b4203a5b02af", "value": "T10F33F1B1E3D9A875C1642B724BE17D22B507039E32F9237316184FD9ED12232D4E67A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351031, "uuid": "25c0559b-f421-4204-8109-fe96d3b99ab6", "value": "1536:09ZHkM9nRjyZJtPeU48yzeDcHBaTTH+/uSvawcz1j:/M9RjybtCByohajTSv7cBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351031, "uuid": "d5bff4e5-812c-4936-a859-0abf0a762332", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351031, "uuid": "153c1926-0689-416b-b268-ecfc2e1deaf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351031, "uuid": "14d1f6a7-ab6e-476f-a758-7056b40cfe19", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c27be0-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321057, "uuid": "48e6f766-a34d-4137-a0c2-52a1ccb45901", "comment": "Malware payload (Stealc)", "value": "13b4f73885f424f73207481d097109fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321057, "uuid": "3eeb683c-ec53-4ac0-8dda-5118bcc9050e", "comment": "Malware payload (Stealc)", "value": "72ba37f28406579b8556ca03137e7c2c4bed79e5fc875e560c017f161840fa65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321057, "uuid": "e2927916-9fbd-488c-8ee8-2cabaf80eaba", "comment": "Malware payload (Stealc)", "value": "83f6fc356e93ca5c6a731387a38b88a761177b0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321057, "uuid": "1c26fcec-d0c3-4994-a831-e8812ca57d21", "comment": "Malware payload (Stealc)", "value": "2befc95b8a40fa20637105e52dc71dea51e413150d659a60a19adae0c20138db2a3dbcbe39ef3443f85941f6abe83bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321057, "uuid": "df976d9d-64d1-4462-8528-266cdaab6b4d", "value": "T10D56CF07FC9148F6C0A5A33189B696527B71BC091B3237E72E60BB782E727E16D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321057, "uuid": "6a0aa2e7-242d-4bc0-ad08-9668ae7533a0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321057, "uuid": "91f86b1a-04a0-40e7-9be9-39238bd24404", "value": "98304:shYuzU3A2HSIc+9nclWLlBF+4h0dMXo32eKjJQh3+zZunB:suKy19n6MlBQ4GR2ZJQh32c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321057, "uuid": "4b9b0149-f4de-4949-a399-002deacd51e8", "value": 6197104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321057, "uuid": "91d48865-cbb5-44fb-8d76-04b0831b7f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321057, "uuid": "166a661d-73d4-4930-8da5-029bf7eb7a72", "value": "72ba37f28406579b8556ca03137e7c2c4bed79e5fc875e560c017f161840fa65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887bc17d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324470, "uuid": "e46d75c9-efa8-40af-8047-32367171c69f", "comment": "Malware payload", "value": "0c4c60720ab0c141493b0e267cae4f4b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324470, "uuid": "d36f5583-c76e-4b15-aa4d-282b39031701", "comment": "Malware payload", "value": "734a3c39773ae8dab54e21d2d3d5d14e57601f0f97e69601d2e2782cd2c1ec3b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324470, "uuid": "33e42d3d-e957-4f9c-ac48-8e06be401f5d", "comment": "Malware payload", "value": "b454c4e9dd7284fccba7622c8b7cb4733f0a1b86", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324470, "uuid": "6e7ac390-af7c-49c7-9e95-448d268e8469", "comment": "Malware payload", "value": "796b71b2c1ae3a4a5c006564b58c0d15d537c2cea372673ed3b1e1fc05bbb7a09537f78cbd7f7182f2623a383d371bd0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324470, "uuid": "649d5780-e507-4f0f-95d2-260aa5ec87d1", "value": "T17021B728D32D78D8D8E320B4BE6B4FD85E05C0588D234A3B3363A858BE79B44A2640D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324470, "uuid": "458a672e-d269-48d3-9029-bef611296188", "value": "24:9q+3in/UeEtCiPUlAfYSgY+xeUJH9O23mkWt/5cpeYV8MXPvb+u:9qkulEzPqU/AJT3TUcpeYVl/Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324470, "uuid": "56e73aa7-1c68-4466-ad18-fb967074c4cd", "value": 1263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324470, "uuid": "28856560-827b-4a1f-817d-a3ea51f19b35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324470, "uuid": "4f46021c-c34d-449d-ae23-d5e3860faa52", "value": "photov_210125597977.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beeadd42-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785350332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350332, "uuid": "910118e4-fb13-42b6-b382-83997d6aeabd", "comment": "Malware payload (SalatStealer)", "value": "8353ae27e81a6a737021a536c2dbbf47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350332, "uuid": "438d93f2-7585-451f-b961-9373cd0ed301", "comment": "Malware payload (SalatStealer)", "value": "75c8b4652b33fab81e814a0bec7ae7ec8c13a24665c14481e66e72a7e9112341", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350332, "uuid": "9db1fd47-a797-4434-9163-ac935daa78c2", "comment": "Malware payload (SalatStealer)", "value": "6d31caff1708a494da26b083939830224c6b2d75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350332, "uuid": "771e3644-1dc0-4e42-bdb2-177ea058aaf3", "comment": "Malware payload (SalatStealer)", "value": "1593e5f0d534c001ada68b7ba835f0f8ec77b41efa7ec224a68543a8bf4ddae04d9d14fe8ef7082f59313ec107e68c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350332, "uuid": "b6ab5929-cef3-4da3-ba91-f4d610a5d889", "value": "T1AF775C11FACB54F6F9036831416BB27F23355D048B28DB9BEB583B2AF8776911C6A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350332, "uuid": "be256056-5c59-4b4c-92b0-5f1c8514d9d6", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350332, "uuid": "cb31f655-00f5-4a46-b582-b3d499ac3ad6", "value": "98304:bc4vDqKrFkCyxyov6XvuRDh4S3HVddELO/:jD1wxxEYhT4LO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350332, "uuid": "8e8050c0-8bd4-43f4-b9bd-ff39a44cfb83", "value": 35190112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350332, "uuid": "94df22a6-1703-4f19-bf95-01291aca44a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350332, "uuid": "61808999-cd70-462f-b8da-448209b373cd", "value": "Xenor-v1.3.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81b3623-8b7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785349461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349461, "uuid": "cb14e2b4-ae3b-46c0-bd3c-6835c7491fc6", "comment": "Malware payload (SalatStealer)", "value": "796ffe1a6e49e48a819e3d7a11456dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349461, "uuid": "d5df8b1d-f388-4f4d-a0dc-10a630ed4fa3", "comment": "Malware payload (SalatStealer)", "value": "75ec6ba7daa02f22c6a1cb3e9d3a642a2ebeaef99128519919f747211e4e84f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349461, "uuid": "d1e101b4-1956-44dc-975a-c1f74877b37b", "comment": "Malware payload (SalatStealer)", "value": "5b5b3ce5844dc27572d3d9055c74cb247eaeb10e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349461, "uuid": "ca28bfbd-a5e6-4b64-8b63-96108a59d0c2", "comment": "Malware payload (SalatStealer)", "value": "d7b91cc041be28108e4fa7c52f9baef0cf59ef61c974d95f47d94f88bf71ac4757fa3bd513491d444875291985befcc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349461, "uuid": "ec3b4dc2-1fa6-4712-b9f6-afec247309da", "value": "T173F5337A1A22740CFD70213D7974A4A382F16E6849D09C251BEF42DB06DA7F8536FD2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349461, "uuid": "61fdc62a-9392-4faa-8b6f-c684060b944e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349461, "uuid": "9affc0e9-b165-4186-b346-ce76773d951d", "value": "98304:LgAUMO/ahBH3JPb8O/cMRx+C+cUEBM9vK3Hu6YSmtcN:8p/kBH35iMSC+xFK3X5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349461, "uuid": "822c7a66-e203-492f-b3f4-63cad08c2737", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349461, "uuid": "84b67718-c186-405d-807a-b8ebca5e5043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349461, "uuid": "aa8ba88a-0c65-4d7b-81a6-60ae1bc5320d", "value": "baritondiscord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebff36e4-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324637, "uuid": "fe49b4d7-afde-4d5e-834c-9258d683fa1a", "comment": "Malware payload", "value": "96d1a7b830c6bef76a2b5e3c34094746", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324637, "uuid": "abe2b0b4-1e6c-4eda-a5d8-344fb4a632f0", "comment": "Malware payload", "value": "762db662ed65d34830b16e15767c05fbb1ccf19255e9b7d691549aa6cb60fd14", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324637, "uuid": "62822e37-1687-48eb-a59b-8769cca925cf", "comment": "Malware payload", "value": "1c1ebfbcf3591ebeef6ba858206a038608d4e5aa", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324637, "uuid": "f2dace75-5eb1-41f7-bb5c-dcc9f2970f9c", "comment": "Malware payload", "value": "c2286249e1a12e9103a844b8172afd724ec343f165fdb3ee6c7020da5aefb88b48f830541efd31bcf5719cb73f3078bc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324637, "uuid": "e6646186-1b76-4323-8f8e-fc8b4c554f3e", "value": "T17521E77C8A1DE231C29EE53580631F481A5C0051A632824ECE69AF2AFE46E644B410BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324637, "uuid": "c098e795-6658-4a70-be56-e1da5ee4aad6", "value": "24:9RVXMWdtLmL7mlwLaRlwI2uwrq6mkKzMhNmW8xjUsRRrp+//:9R5MW/L07mDwrq6TK8NDujlE//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324637, "uuid": "4b4ba26e-2dd4-455c-bcd1-d85207a185b0", "value": 1275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324637, "uuid": "0967eba9-dcf5-4496-ab66-646a0a417b59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324637, "uuid": "60fa3484-55fe-47ed-94f5-541b64654f5e", "value": "photov_916855168558.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d6ad13-8b93-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785360252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360252, "uuid": "5fef0f1e-ac3d-442c-bd67-1a369372c106", "comment": "Malware payload", "value": "e8d387c552c63596797ec59d17c5b08d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360252, "uuid": "20642250-ab8a-4c52-91ad-73ea603d42e3", "comment": "Malware payload", "value": "76bc2cfa58c82672d1cbe9112bcec4e8e7935a53b1db21b0f5731cf96fadcde6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360252, "uuid": "7e89094c-2ea4-4bf6-9ebb-5fb0c86b9759", "comment": "Malware payload", "value": "860da3ef07eef55ffab4685574690343cb11ba9c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785360252, "uuid": "cbdcc472-7a1d-493f-af37-d3d2e5076df8", "comment": "Malware payload", "value": "21872ef9732334fd2aa798d34c203f5ef7082c7db4addf45ae25ca7b66581d8ff56a2ccb0b0385ba9655a1df1825db87", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ICICI Bank", "colour": "#155AED", "exportable": true, "hide_tag": false }, { "name": "imobile", "colour": "#86E33A", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360252, "uuid": "4ffc219c-9bcb-4b34-96ff-1a43c2367230", "value": "T17FE63306F92D4C6DD8B635783D14C34638327CA98B12C28B3561B37EBEF3AD1976A161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360252, "uuid": "e43df17e-6aab-421a-b15d-eaaf85ac1072", "value": "393216:RzKkFcynFDsD/e0yUsoO9EwDb6wxLL9MQF:RzfFPnFQD/Hx53QLLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785360252, "uuid": "9b8fe7c6-16d3-492f-b05e-bf53f7b70978", "value": 14629762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785360252, "uuid": "a025bddf-b814-4c54-9ece-88c899e23e4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785360252, "uuid": "da5660c8-1c22-47cf-8e41-db902135b680", "value": "imobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32068fc7-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327332, "uuid": "dd9f9bbf-dec2-4d96-a3fa-2bcf33c7ef7e", "comment": "Malware payload", "value": "ef2576d671a6fb21b0c75635c232c108", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327332, "uuid": "26112aed-3b09-4f43-80f6-e4a678d59f36", "comment": "Malware payload", "value": "76f31ade7064e808784e930b6d19ab13c44d016843ca3e4ea240dbc021aaa802", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327332, "uuid": "f187c349-5e9c-44ce-940e-70111c8d367c", "comment": "Malware payload", "value": "8e6edef369723a94ee7d0c876a10396ae9d4ee2b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327332, "uuid": "ea6ae850-d3ba-4adb-b3c1-d70b81a31747", "comment": "Malware payload", "value": "12c85ec22ff2e5213b6ed0231a379fb6ef6e2a1601dc0fc666affbab25ae9ef8000282c505a217c947dd9197abf03acf", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327332, "uuid": "c599f67e-304d-4214-acde-2893c6890890", "value": "T113D502FB58B265536B904663EA0F2C0A339B19D53724D342EA1150AC7F7B1D38EA2733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327332, "uuid": "a25d9a76-20e0-4928-b9f7-44b4a177631b", "value": "49152:pOc2yD4lTPeeA3l4BQSH//Y0T54pDv3rf7eFX0j6FTsresx0Y4HrMom4k:poyEFPo4BQUAWA3f7GHTsrdq4om5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327332, "uuid": "ffbf35d4-2921-4c29-ad39-538634f8e4b6", "value": 2993564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327332, "uuid": "55b3f4cc-cf04-44d0-87d5-a177603d13d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327332, "uuid": "01cf2880-49ce-4509-95dc-9fcd8bcb9d5c", "value": "TIN260600214.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00db69c-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352964, "uuid": "b9e2770a-9d26-4584-85e4-9cd4148b51a2", "comment": "Malware payload (Mirai)", "value": "f9017ea42eac2a02697bfcd5b7f14bcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352964, "uuid": "5fbec395-2835-4954-8a07-59292bf0df03", "comment": "Malware payload (Mirai)", "value": "77580df28349934bc9b326713207109426c53962fa030405668004c2175d519b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352964, "uuid": "a3e12df8-a4de-48bf-840b-25cc264a6a78", "comment": "Malware payload (Mirai)", "value": "621b75f72e90baff3174aab0a628a575297500e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352964, "uuid": "48020b30-70a7-42d2-84d0-42697758dba4", "comment": "Malware payload (Mirai)", "value": "bb2feda7c81bf4e04d71f64208242ffe8853f0763a8601cdb08272758a59fd598f8c73a86a3ba9bac45761725262aa0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352964, "uuid": "61f65a5c-60d5-4509-a5c4-a1550ebf48e1", "value": "T1A0E31A56F9819F11D5C151BAFF0E128E33131B7CE2DE72129D24AB707B8A8BB0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352964, "uuid": "462a2b6b-e573-4a76-a1c8-5a6e68e3e8ac", "value": "3072:c7mAoCw7QsuWvDetOOTraSiG6FlYBY+NEgYDLgSi/tQj9Usg:c7/obvuuStOOfaHG6FW3NuDLg/teXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352964, "uuid": "2044c7c1-329d-499c-ba98-a3239e466691", "value": 151732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352964, "uuid": "ceb118f2-f776-43a8-b9fc-185d96593477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352964, "uuid": "eaabc3af-2e91-4434-b8ee-f423ce7e6ceb", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1196db77-8b26-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313104, "uuid": "0385fb11-5f5c-46e5-b15f-9d605d10008e", "comment": "Malware payload (Mirai)", "value": "850d85ca27bf7fd81b78ee4542c4fd18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313104, "uuid": "c1110393-9ab8-4cc8-826d-6d42a9a2421d", "comment": "Malware payload (Mirai)", "value": "775a1891fbbc3b77a87b57715e24fd3fa43fa21b2f676d5e0c1b4af57b80abef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313104, "uuid": "3ccadf63-bfd3-493d-8da7-c2b46f1f687f", "comment": "Malware payload (Mirai)", "value": "fcea065f076898425f72957f7b5710f6deb84218", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313104, "uuid": "2cfd968a-e3a2-4a37-a59e-de4372cbb05e", "comment": "Malware payload (Mirai)", "value": "49a55af5bb11574b068aa0a583a455ffc6eb772f36c4b122f07b961af2d874d25719d4a0de8b75077cb40e8c0a9a60cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313104, "uuid": "7b254089-fd96-4498-8ead-80c21446b918", "value": "T1AA73D70A6E215FADF768C7345BF74A21A39923D623E1D684E65CD5001FB034D682FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313104, "uuid": "864c7d74-940e-428e-adb2-0e77a60474f3", "value": "1536:Wxe0zH+BbnIbKNzYXrUVpVMAyI6qYnD0ne26u:WxeKH+BvOXr+VGI6qYngou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313104, "uuid": "e26fbd96-e144-4a50-90e1-e0bd7cc7afe5", "value": 80652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313104, "uuid": "79c9299f-8ac7-4777-bf66-db0136c5648b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313104, "uuid": "f7692909-1f91-4526-ad47-1f2360a8f0d5", "value": "bot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d01d88cd-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324591, "uuid": "f6366514-42a0-42fd-b789-f5a891af8dce", "comment": "Malware payload", "value": "b6dd10e161aa17bb9abe68d508f427fb", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324591, "uuid": "df93074a-3c52-4702-b05c-94fe130dc229", "comment": "Malware payload", "value": "7772db3f5485066f41830ec76a1b1452566f79a42659f3cdf445eab0593d9518", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324591, "uuid": "c189942e-fe98-4226-9d5e-69756e44283b", "comment": "Malware payload", "value": "a1a0acf26b3f793009069baa4e1145c4f1f95f67", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324591, "uuid": "eb2a7390-8db8-4087-a5cd-ef8be86cb234", "comment": "Malware payload", "value": "38213a696ce5b0ef140593f2f1af6e2b779646214adaa1db338973a28f7c1e43e98c07aeb80082b15cb025ebace10c55", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324591, "uuid": "ab6782fa-a0ec-4fba-b842-b80edd775b8b", "value": "T15E31C932D649C1F6FB0DD234F45E02CF21A55078D543985782511C6E3A1F6A134C6C1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324591, "uuid": "a8e3aa1d-16d8-4e63-a36d-52fe3e072f5b", "value": "24:9XhkIxASCdTUWDtqVMWqMESzvIgGck/Q18PJHSOypmk/H+UaNuUamv4XR7vuqBfh:9RZxHCdTUWJqlqRSzIP/Q18Pp8T/H+UD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324591, "uuid": "37cd8426-0c99-40ab-ba85-ef8c3d3492b4", "value": 1483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324591, "uuid": "97578647-e71a-44fa-857b-49088e3fb8e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324591, "uuid": "a3dab0ba-c4d8-4c6f-bb13-c74df665f4e2", "value": "photov_933994967404.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7305bcd-8ae6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785285894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285894, "uuid": "32d05d06-7fd6-47b4-a1d4-926ce886794a", "comment": "Malware payload (Mirai)", "value": "8fe7e99183aba55c587dedaa70861c41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285894, "uuid": "445159d5-6a47-4eaf-82b7-f0573bc89b4b", "comment": "Malware payload (Mirai)", "value": "777e17fa8a709873f33cdbf7793948ae2f1c84dd7524c2f1fd911d4c14c372cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285894, "uuid": "4be3b6ac-066c-4979-b597-bde5a1ab826e", "comment": "Malware payload (Mirai)", "value": "705eacd9669c15d16c4f09ba2c24eeec5bc384bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285894, "uuid": "48647ee2-183c-4773-a11b-4fb924313cac", "comment": "Malware payload (Mirai)", "value": "0d3a26c749227f95def7076afdafb382d12edfacb9e4283cc6a5071e1b5eacad861b07e18961cd4c63c4f16313e8c49e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285894, "uuid": "f418f03a-2ba3-4804-bbd2-77e60871ae44", "value": "T18F634B2731356913C0E0E6FA11B7C762B2961BD91388D3CEBE630D5FAE263405966DF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285894, "uuid": "2b7092c8-5839-4192-8a92-bf295d0ac896", "value": "1536:5TIb9b1T9nVnE4+b2nFw7HM/3zoBZ+/jcqZfiV09bdUJ1:5TS9b+4HFb5Aqon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785285894, "uuid": "b0f83d9e-29b9-4380-95c5-e4c567736852", "value": 69376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785285894, "uuid": "33395942-0325-435b-b498-7a0614219d9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285894, "uuid": "9f51c461-0f6f-4cf6-a956-30a6d90819e7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52888e75-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354445, "uuid": "1bd5635d-18d1-4565-b5f7-b8f55b299a88", "comment": "Malware payload", "value": "732ca97070f214e5622d78ab17e9f205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354445, "uuid": "59f7f0cf-a4d6-44a4-a35c-848d151e1c01", "comment": "Malware payload", "value": "78906623ce30eba7174e99d7f9d1df5fe69d1fdd7d5eb36329963e29b65bef2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354445, "uuid": "87211849-f29c-4fdf-8e65-712976d50c03", "comment": "Malware payload", "value": "b5e01bed601b42966fc7ae98826d9782b8cb486c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354445, "uuid": "666c97b3-ed78-4b47-99af-49c9a3336e47", "comment": "Malware payload", "value": "dd7ac0c189cbfa0a2329ff31b18c01272ee02103fb0e7b3773c35d2e484fc9ba832ad493f7276e9005d075b12d75c00f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354445, "uuid": "be29ead3-748b-4d1f-b8c8-c9c85c4ca66b", "value": "T196747E1699A5B0C6E01B9A339233D517CF75BEB59A63E35FC269924B0E333804F26DD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354445, "uuid": "82510a36-4cd6-42d4-b607-96f9b1bd0f28", "value": "bf949854a0fc6d2bcf5bacdd08688a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354445, "uuid": "b7d97480-3230-4f88-afe6-3689c93945a2", "value": "6144:wWpPOSAUwgQesP9WfVntuOI3nItmG4soji:RlOgQeslEVtudI6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354445, "uuid": "7c445036-1951-425d-9de3-ffc8a91d1709", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354445, "uuid": "60044f38-6e16-410b-9d4d-87cb55e299cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354445, "uuid": "15c2ff0d-6fa0-45ab-b8bd-11a1534e48c9", "value": "78906623ce30eba7174e99d7f9d1df5fe69d1fdd7d5eb36329963e29b65bef2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a112f4f1-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324512, "uuid": "d2fa524f-f477-4237-9674-653b9897fb0f", "comment": "Malware payload", "value": "09c3704a283ae2b2f636440a4ea3b1bd", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324512, "uuid": "30f3e3bc-19d4-4304-8860-c97537c5aaef", "comment": "Malware payload", "value": "78afd6d38e77223e91428bcc55bc697419673f0793e93e284bd4f57fbf37178e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324512, "uuid": "85e44731-ccc1-42e7-81f0-ccc3dcdda360", "comment": "Malware payload", "value": "c7ddca62307611bb88424fe1471f8397d4bf37cb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324512, "uuid": "e88b70a4-b361-46cd-8991-38d929005bab", "comment": "Malware payload", "value": "608c37efed5c729f6e6d05a5a4ac7a18f25024a1c094be511082a6294bac419e5251eade5687d36c9628fda1e986e43d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324512, "uuid": "e0689e69-5575-49ac-8e8b-61528d08bf26", "value": "T12121775062489EA4CACF72716C829C1A531E45EC000A38EDA99912C17AE69DADF02029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324512, "uuid": "6331b0e6-0d41-46eb-bebc-7e280d4f8622", "value": "24:9q6zw/T0uGPTNEPDuOI2WlfLThLCjmkI1A4P/OINoHJ11/O12X:9qwGbPRWfLtLWTI13ZolN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324512, "uuid": "d0751820-0ed9-4584-a59b-f06fa70c60a0", "value": 1235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324512, "uuid": "580d5912-b4fc-43d8-8cea-57df88cea528", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324512, "uuid": "e4ea0244-ff7c-4cf8-b161-96f11e68dc35", "value": "photov_248326188979.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983f89bc-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321061, "uuid": "11980122-9081-4f33-bb1f-33aa2758ffd0", "comment": "Malware payload (Stealc)", "value": "d1b360a94b3b6acd26d04e9b2cde1df1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321061, "uuid": "253cea5b-2218-4a8c-9807-d3462ce7d19a", "comment": "Malware payload (Stealc)", "value": "798b6a521d6763f1b684f6d2a6c91e3eab92425dbd9265372a132aba1e213c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321061, "uuid": "24c7128c-0062-4d3f-a2f6-9277b5399f3f", "comment": "Malware payload (Stealc)", "value": "626b4ea13c888976c077fd44b3d0d187a7cca20e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321061, "uuid": "615fa2ee-ba3c-47cd-a3ac-46847a5a831d", "comment": "Malware payload (Stealc)", "value": "81505e421678e14ab2ef7d3c33bcf78b6bff201655d99893144d5d6fb0077c2fec37d4d50a43f52fd9aada50ff84497f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321061, "uuid": "a5e89acc-173e-471c-a9c3-0e0d36a57044", "value": "T111F49D1BF7A502FCD07BC174CA424952EB72B8565330A69F03E15AA61F376A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321061, "uuid": "b19e5dcd-6de4-456e-81d4-2ee5bbd6a08b", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321061, "uuid": "65fb5bb9-73dd-46e6-9447-451a638742c1", "value": "12288:eCHSXamiqz8TbhvbTOMfJr6EmnEMGyxBlDetAqxSvSc:iakzIbhvbCCJ+pEMGybq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321061, "uuid": "33268da8-8f29-4e8d-92e3-6f467c3f7145", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321061, "uuid": "5dd00ea3-af82-4273-9744-1d725e63f4a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321061, "uuid": "b9f37219-ed07-4ebf-a52d-c48447492a52", "value": "798b6a521d6763f1b684f6d2a6c91e3eab92425dbd9265372a132aba1e213c5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d845f3e-8aec-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785288213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288213, "uuid": "0d00039c-f58b-461c-88d9-5a5e797a8121", "comment": "Malware payload (Mirai)", "value": "8a0fed1a5a5ed0c161ca63b92dda3bdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288213, "uuid": "21d7d30b-ab47-4c62-8894-e0d540464e28", "comment": "Malware payload (Mirai)", "value": "79df12fb0a083f52bf77cffe998c9be6e9f588b7f918af11435fc5629c1d82b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288213, "uuid": "4021247c-198d-4343-a8f0-845165ad6444", "comment": "Malware payload (Mirai)", "value": "f204f8e410bd99c14b8a7660e157103fda2fefac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288213, "uuid": "50e18a66-8a7d-4989-be7e-47609fbbde6b", "comment": "Malware payload (Mirai)", "value": "b506df470b767e20f96239c4d99276e14470668ddd57a3b421c9aebdd6994d50af87be0d601e261b117e24b8adb0a78e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288213, "uuid": "2083ceab-31ed-432d-880d-eb397637a764", "value": "T1F3043A02732C0D03D1A32EB03B3F27E097EF999221A4B541295F6F9E9175E326945ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288213, "uuid": "0805c40e-9f0f-47f0-9fb8-8db2e2ed96b7", "value": "3072:8pK5PKdRpSMKN5FZXJx6qPSPYV7zxgzVu2:gMP0qXxBPSPk3xgZu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785288213, "uuid": "4982419e-5705-4680-8fd6-3fe4f1cc479e", "value": 173816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785288213, "uuid": "7f2c05a6-0d0a-4b4c-9342-04b8208a931b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288213, "uuid": "e5cf27f2-eeb6-404d-a65a-6cd0eda27843", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99c9f46-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324553, "uuid": "78312365-1635-44be-b0a2-2cdaefbc6441", "comment": "Malware payload", "value": "63662fcbc1c44c22fb38d2ddb88ba436", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324553, "uuid": "d0c96ad0-ac59-4791-b2aa-99ca1dfaf750", "comment": "Malware payload", "value": "79f402d7d3ec9e53e03aa1b4fcfc39be316a224f00f0730d863ca70ee74e2a1f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324553, "uuid": "c06a7294-81f4-4eb2-bf62-7f7e8dd3843b", "comment": "Malware payload", "value": "c7be326678e989ebf23be72a4a1ab36890594624", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324553, "uuid": "2af0df5c-7034-4381-af89-a5bc4f9b8552", "comment": "Malware payload", "value": "9179c6004c366aef1df45d96930fbf113f435ab7725fa56d6d819086172e5fcb9fdf7fb470cfd078b64020aaa9f7cf81", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324553, "uuid": "60980d25-a391-4dee-9bc1-28495c44e31f", "value": "T1D42108DE8106C3D4D11BBB32B8D5165432AC5379EE7585812222988ABB8F1862FC763B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324553, "uuid": "e37e9fba-71f9-41b8-9f2e-5071dbc8295b", "value": "24:9niNDi22C1ygr+WBG+Oa2kGXZzXdrp8lzZ/fQdD7Fr2wZh+AzHAmkfYF+UaNuUaB:9HKzr+KOdnXpNN8lV/m/Fr3HxATfYF+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324553, "uuid": "1a3ccf14-5e05-4a9d-8e5a-b0e573789b40", "value": 1418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324553, "uuid": "ba8fcc6d-d6b2-4727-9181-0524e52b3e02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324553, "uuid": "139b6692-e6fe-4e09-9704-056ecf391688", "value": "photov_154131790460.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7325cda2-8b49-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785328300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328300, "uuid": "98e78a01-c703-487f-b629-837a3fd91ffa", "comment": "Malware payload", "value": "4557791803d72e7ad20bf7fac92d34ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328300, "uuid": "e6c91185-ec48-4738-a32e-e90407d42dd8", "comment": "Malware payload", "value": "7a0e34e5f3787471c5dc473771594ddcc57eed50bc89dfba8c27f049770e4cdb", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328300, "uuid": "202cf298-7439-4639-9391-fba7dfc24bc1", "comment": "Malware payload", "value": "e262f8047cfc00da4fa92da6ccb43b1410018a91", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328300, "uuid": "3bb86863-9f7e-4bc0-96eb-c2c2ce6bc971", "comment": "Malware payload", "value": "2143baf72ae30071e371ceaf9515f83e0859015b9e4ea84d57cc257f57a2fb6e7117b7234a98f7f2c614140f70e9b567", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328300, "uuid": "35f02872-bab9-416e-87a1-ba01f79856db", "value": "T18AC27E956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328300, "uuid": "6ef5f22b-fba8-4e65-b7a4-f8d52a7e918b", "value": "768:+N8vCB+25j6es8Rk9FYpMSUpi+20qUpi+20YQX:W8l25JCd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785328300, "uuid": "3bfa403e-44c2-461d-935f-583014af8652", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785328300, "uuid": "b64914d2-68d5-41d6-a66c-991311282718", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328300, "uuid": "fa87d1c2-b8d6-4665-936a-d59d872ec5b0", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef45ec1-8b0f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785303329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303329, "uuid": "80d6a0ea-f489-4f81-92f4-4ceb65cea913", "comment": "Malware payload", "value": "187c737fbc123941999ae077fce315b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303329, "uuid": "f1bd23d1-23d8-4b33-8fcf-634c657aa98c", "comment": "Malware payload", "value": "7a3515a3a1718614dcff61ddcf0b9984b7bf105ecd75fe2ff6f832589a93fdb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303329, "uuid": "b24efbc2-dfe8-41cc-85c2-6c9e82936ef4", "comment": "Malware payload", "value": "6f1f1b197d111cca4f60e8458a0aea32576ac69a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303329, "uuid": "76e29024-e2e5-4b97-a107-2b28052b8f16", "comment": "Malware payload", "value": "d9bbcd1faac65381e1606a46fe60f29fe408d787c9166bf44ccddf14d230c52cb1f5681bc25f11c17a73f790dfc4e176", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303329, "uuid": "7e044826-3f0e-407f-9fc3-0033a0a7c708", "value": "T140A511FC7B8436828A3D4B81BE01DA41F035A67F0AB3669EF455EED039CA10345A7DB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303329, "uuid": "cded0c14-5d62-439b-b6d1-ba5057a89e75", "value": "384:8FBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBFBL:NI8sZX2N6KTbzniGzI0bznO7rIWQWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303329, "uuid": "fc5dfc17-af8e-4d9c-b305-da0cdbb75c4f", "value": 2085309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303329, "uuid": "d9c7d7cd-f2b0-412b-bad1-030f4c2735af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303329, "uuid": "71f361f4-011a-406b-b6f7-5685f1b66804", "value": "SST013_B16250732000788_20260501_1stReminder.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39d9552-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324570, "uuid": "a169cdd3-c12c-44d6-8cdf-a09fdc7f6349", "comment": "Malware payload", "value": "6e1a6bdc437d1ab50ffe4a0f9e586e4a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324570, "uuid": "ed461179-5929-4092-85d4-4c19e4dba014", "comment": "Malware payload", "value": "7ab8371dc44a606e6ae0f5d4311569fc0f2238ad9f9e812b484398a03785c08c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324570, "uuid": "69708bd2-55ea-482d-9f2b-d7df459bbbeb", "comment": "Malware payload", "value": "1c078335d63df335ca7542fc348c5d2d5b5ae4bc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324570, "uuid": "3f8641c4-4482-4c27-bc91-f1c1d0a05ff3", "comment": "Malware payload", "value": "fe8ad646732398f9b0791aa7ada60a38f7750754c8dbcb79554836bf41d0e4add7bea6361abec9bd0dcbcdce4264fdf7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324570, "uuid": "db18179c-6631-40ff-b51c-40437f1da8c1", "value": "T12E31E911D6064175FF19C3BB3C814E16F50450BE80CC85BB37A4D29AD7EF6321B840AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324570, "uuid": "27160a42-bc16-4cd9-bcb6-4d0d90975e52", "value": "24:9+ESnaA5s79Mfb7e88fCEWKPGtgFrLKNNRDmk4bW3sW8xv4vHEmi8e3Rp:9+/nXu79i7r8frTutWfKNNdTZ1uoHErf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324570, "uuid": "e483c174-675e-4082-b2b2-031f9ec2b026", "value": 1486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324570, "uuid": "449ffae6-9114-4cc5-8694-a569535011d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324570, "uuid": "ca8cfa4f-9365-4c9f-9255-65cdf01c7621", "value": "photov_980911262403.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71337be7-8b7e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351060, "uuid": "85466106-89ac-4778-8841-7d3b79fccc43", "comment": "Malware payload (Mirai)", "value": "9bfcf65d6b3484ce8ba4aa5d64b6592b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351060, "uuid": "e31e968a-7189-4828-bbea-14552952e99e", "comment": "Malware payload (Mirai)", "value": "7b09c0ac5c43fe1e0482d991c2c3c6ce01dbdd6b61392391df41510ac0114a35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351060, "uuid": "fa8120e9-7e8a-4e25-82ac-fa3e75686779", "comment": "Malware payload (Mirai)", "value": "fa3dfba3b9334d0df227c90aea084e78d2facde5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351060, "uuid": "cc9a06fb-601d-4ce8-9d0e-4c1f3992fd23", "comment": "Malware payload (Mirai)", "value": "be6196f30ae2ed04f540510322fc8181a9d494cee058505865afb87cafa87b18abebc3c5ed6726eb43d87e28f7510533", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351060, "uuid": "88b09b5f-f654-4d86-b419-9e778ebffc77", "value": "T143F32B86BC808B02C6E161B7FB4E428E372643ECD3EAB1079D196F25379B9570E37651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351060, "uuid": "3875fe69-d443-4a12-b757-fbb3f7c23e4d", "value": "3072:KD4edjwEPR0r7lR9tN4YySv7OqWt77qF+g:KD5dh0r5btN4Yrv7OqWti+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351060, "uuid": "c7fcba66-ad75-4164-838f-c0ef324989d0", "value": 166144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351060, "uuid": "aa020555-e3f2-4d2e-9cce-72e7c5609d38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351060, "uuid": "e16ebabd-894e-46ac-9a1b-faf872cd76e7", "value": "zero.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7592705-8b2a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785315154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315154, "uuid": "66ddfa93-acee-424e-b4ae-920582e7e8eb", "comment": "Malware payload (Efimer)", "value": "588cc21803e59eee9eb92b6acdb136e2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315154, "uuid": "08404078-d5d5-4123-b627-c4c2698f5187", "comment": "Malware payload (Efimer)", "value": "7b80dec3ee801e2d7d11373961448a7217078cb2721aef71fa2fd19534be3794", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315154, "uuid": "88af1e86-aaca-4769-af1c-23196d52b015", "comment": "Malware payload (Efimer)", "value": "f4c5f58a12d3daa4a9060d270292f83bed7ae0e0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785315154, "uuid": "08b078e7-05b3-4673-9caa-2f6951c276d9", "comment": "Malware payload (Efimer)", "value": "87abd50dc833d6a75cc29645fa474b28ed4de5830a6bf6ea624890ea220569c0e4ccf5eb505e6ef4513d50ea9c50c9ea", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315154, "uuid": "63811306-de23-4bc9-8416-4a7eb8d23cf3", "value": "T103E63358DBE406EEF2A3017DDAE14A4AA5E47C214372CBCF0B6897919E172D18D3E713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315154, "uuid": "8f90a932-87f2-4d97-97ef-62789c5234d8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315154, "uuid": "582a3d03-2ab0-4819-8344-0942cd54d963", "value": "393216:XLk9U6Yt4Wfbzd0/SZEQUXMCHWUjXOcuI3/PGTAI:XAKt3fbztZEQUXMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785315154, "uuid": "22ee15fb-f3bc-40fb-a35f-4d73d9849ec8", "value": 14315163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785315154, "uuid": "cdd73086-f9dc-4ed2-a4f7-8e522bbd1f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785315154, "uuid": "41c27ac6-ccc0-4af5-af0c-4ecf7d5fa795", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c9cbbd-8b26-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785313277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313277, "uuid": "34b9a4fd-a47f-4483-8527-3b76048ca22b", "comment": "Malware payload", "value": "da92751c68ab27e160c113fd41d668d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313277, "uuid": "714575d6-3c0e-4b93-90dd-19aaf0132a0f", "comment": "Malware payload", "value": "7c11e9050747ab4e1b350fbfd4d3b2c31dc663508cda277a223d1f55600735ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313277, "uuid": "4c0a1386-420d-4fd9-99b3-c8627b4198c5", "comment": "Malware payload", "value": "ce04a94fd2cfcd2164b06e3f59c620a3f6b62901", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313277, "uuid": "e0852d9a-5029-401d-a8c1-50b3c15ede2d", "comment": "Malware payload", "value": "2c6ba261f05df5886116deb6126762fec1c10bc4eb8d1b5e48d38d3da9e12622295712585e54689b3c776abd1a16777b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313277, "uuid": "bda26624-d1ba-4b79-b08d-21ca462c10d1", "value": "T12101ABDAD554AD1040A9D56D23DB50A4F420C3C61A4ACBB9FFACA83DDBC4D14B07AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313277, "uuid": "87fcc433-ae9b-4faf-ad48-0b86d9735c81", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkalFCpQTUCnnl1CVi1XC5gq8CGbYX:kXCKysE2hi0ziQvZohafcDQ14i5Z2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313277, "uuid": "41a333fe-daf7-477f-ae0d-ef19922e73cc", "value": 844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313277, "uuid": "ded1ad3f-b3b9-4c2a-b121-e710e2852063", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313277, "uuid": "2c68262b-975b-4898-9dba-c75afcaaa910", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3140b16e-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785310580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310580, "uuid": "4adc907d-1685-4293-bdd2-1a5fa00bee32", "comment": "Malware payload (SilentNet)", "value": "7252b537f8b35dfe82f596beca7fe4e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310580, "uuid": "c391357e-23b5-431d-9db7-8cc06f5e8641", "comment": "Malware payload (SilentNet)", "value": "7c421556d7798939bfdd5cf2cc5bd7b441224cfcd85b8f06858587a0f3e22871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310580, "uuid": "595db373-9f81-422f-8b71-6fbf22878db8", "comment": "Malware payload (SilentNet)", "value": "afd6e8ae6b1eee1c245cb4ae9b4a6bd9f8d8b38f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310580, "uuid": "d3f94fcc-ad20-4cb8-8cd1-044599e2b874", "comment": "Malware payload (SilentNet)", "value": "f98ab16930cc4b6a514a559e25956a7d6e517be1e2f2b8ce99a4543c694905d702885a457be7ae2a34d6a540c218934f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310580, "uuid": "d5ab1c1a-e5d2-461c-bdad-860ed8e8529c", "value": "T199357C83EBA3C5D8C156C8B5534BF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310580, "uuid": "d11c110e-6013-4db3-9795-779556620bc5", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310580, "uuid": "52b25fec-857e-4b38-ba14-ea6e2bd95507", "value": "12288:UZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGgvPqItNquB:Ucb4M06WpoPrwnvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310580, "uuid": "c93f0f10-0a2b-411a-abcc-c85cec998e48", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310580, "uuid": "54151ad9-e16d-4ae3-ae8d-38334b8ffe73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310580, "uuid": "0dd85a95-8f82-4604-90f4-19f22a3e3408", "value": "Valorant Trigger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcbce4b-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305233, "uuid": "61ce3e55-138c-40c8-8e0b-06007c59d60c", "comment": "Malware payload (Copybara)", "value": "e792fedfd11d56a9ad68e6d407b9a09e", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305233, "uuid": "ef676701-a3e3-454a-a0ff-923403d5e887", "comment": "Malware payload (Copybara)", "value": "7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305233, "uuid": "d4a58bc1-eec8-425c-9e07-b35ebc8ac0ba", "comment": "Malware payload (Copybara)", "value": "98a5527529198994d91d98e2e51bdd33f4e2a672", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305233, "uuid": "a3fe51bb-b5be-48f5-b438-d351a67a3907", "comment": "Malware payload (Copybara)", "value": "b4bd486348b66c62cb6e3607f1d914483f469a19c250afe61bbdef0f66d445ccdee50a0da862b5a16f7972dab88b837c", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305233, "uuid": "8290458a-041a-49a2-9423-9944e4d42120", "value": "T12796330AB742AB17E17316749D7241DD017A6D18CF575213B6A2323C38F9FC08F6AE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305233, "uuid": "793de108-803c-4c7e-8bbd-3d5ee4761d1c", "value": "196608:3k0xB/r1wWwPLCLH+QN4ut1eMSCiYfEWNFFimfgSS9NZlJLXCCpmvwmaf:7X1xwPmLH+luHeFgMWNrTgNtPvmvwDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305233, "uuid": "dcd5589b-bc7e-46e8-af30-ec4087e24261", "value": 9378448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305233, "uuid": "a2da24db-726a-4aad-b75c-3d94cb5aae0a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305233, "uuid": "6af323a5-cc98-4526-9ddf-a4a5fa3ebc13", "value": "7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e294c028-8aef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785289832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289832, "uuid": "6a8760ad-b6af-4930-b869-a21cec54753c", "comment": "Malware payload (Mirai)", "value": "734ea4993da57f44368650260febf468", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289832, "uuid": "ef9a94b5-742b-43be-8a16-72215cbe142a", "comment": "Malware payload (Mirai)", "value": "7d6f5eb4bc8cdea4b40f7a3f659c50b35020602abdd8e8a2e2fc31732330a92a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289832, "uuid": "9ba14248-e399-4046-95c6-2b45421aba03", "comment": "Malware payload (Mirai)", "value": "f3213afec77a01847857e9b01278c844e4bb4e06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289832, "uuid": "dd399838-43dc-4f40-a0cf-40e5897c5bf0", "comment": "Malware payload (Mirai)", "value": "672b5255247d90ad0ead2afe5f09719fd40e46f628a8330597c8ef97bad3222f1ab776d91b4c37ad6b65157c2188cb9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289832, "uuid": "44104288-f337-47ec-b37d-8c76ed21f974", "value": "T120E3BE9BBA8B0090C44701F0278F4BEEAB6315859FAFC2E76D69B53B083D1DB9516B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289832, "uuid": "657aa49b-d17e-426d-a69c-c9a5ef49b045", "value": "1536:gVVaAFrSKjNLdqmK8jdfObjZAPxlKkNFap5nrRIgTKa10FHiqJ2O/LWSG7:gVkitN8/8jdmbFAPx13aKgTflOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785289832, "uuid": "518f359b-cee8-4813-bf9d-e1843cd2a0e7", "value": 150200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785289832, "uuid": "bf84e451-958f-49f3-a827-93a78c755adf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289832, "uuid": "f223e81f-6de8-4a13-b51c-e9cfba885901", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3783eda-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350312, "uuid": "017adf93-9acc-4ab2-b02f-c2d5017b96ee", "comment": "Malware payload (Mirai)", "value": "badf8032114b571ce6434854e4b7f8fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350312, "uuid": "b670d6fb-74e1-414e-ba63-7e034450cc46", "comment": "Malware payload (Mirai)", "value": "7e3b9c7b7f848252a548877f6bde45d9c1b7e4d293e95ac87f5d3907f6dcb4bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350312, "uuid": "a91cb229-6262-44a5-a987-9ecf6df271d1", "comment": "Malware payload (Mirai)", "value": "3e1f3939e1c2ee42b476a163ccd7ad1958324f12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350312, "uuid": "ed1eb687-8755-458b-b40b-3feec90f2b81", "comment": "Malware payload (Mirai)", "value": "11ad241d60628bed4c56037301145cfffe52fbe2cb759089e84632cfb82141ca92db3f0389a1f53b7629d728094f3106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350312, "uuid": "1e43af37-3eb3-4622-aaf0-10fda7f881ec", "value": "T181834B89F783E0F4D94705B1116BB77E9B30DE525124CE5BDB94BE76AC32702A12A32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350312, "uuid": "0070d60a-f143-45fa-916f-97c9f346148a", "value": "1536:oem4oBQnytVxsD0IZKywh3eoZ4OLno4DLCWPUb314NNPrKVylk2ir:oeBnYVu0IZvwhOoWjcoivrH3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350312, "uuid": "13bc4ef7-0d42-4e40-b797-7ddfdd80f833", "value": 86784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350312, "uuid": "d964366a-6522-4ad8-889a-dd65600c6d7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350312, "uuid": "5d92a513-10f5-49f1-a851-5da2981511ea", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c37936-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327397, "uuid": "8f57f2c1-449a-4b29-b8b2-e8468984003f", "comment": "Malware payload", "value": "3d71160ee88f80d72187859b2f4e8ac3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327397, "uuid": "7a5ba109-2d2d-43a6-9067-d15d91e98b81", "comment": "Malware payload", "value": "7e4549de761b5bdb361bf22e3f3069539400448094c45d2e84175d76b6553853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327397, "uuid": "dccc029d-cd8d-45e8-b19d-cb6c757ee615", "comment": "Malware payload", "value": "44ab814aa3eb38ea0f82bdc43f8d02b905792e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327397, "uuid": "d7843d36-a466-4c5e-b7d0-22710a204773", "comment": "Malware payload", "value": "31412872f634ba6edecad53d8279fc61243a927c3f7476a5e1cd3dd27812f083d39d74f65b4c1ee8695fcaf9937cf752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327397, "uuid": "5d223066-7733-471a-8fec-b1d294598a65", "value": "T1B9749E7722B404FBF2A150F6D89217D19F6EE8C1FA217A5ACF4021C56DA37B05D386E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327397, "uuid": "6ad21d90-cda6-48e2-93a2-9bc857fc6f24", "value": "1bb9f9d2ee0ced9693baf2f68dc7a4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327397, "uuid": "16c7c3b3-79ce-4968-a250-606648f321ee", "value": "6144:8GzxCIdjiQoz9q3BCldwAxXgg/96MaBBmVwU87CVb63vZ3AK3OQqZeCXtdBhqR:1zViQoxbldwMQg/AMaBiih/Z3AK38tds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327397, "uuid": "facd20e7-7d90-4383-8398-72ceaffbdc67", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327397, "uuid": "d235ee90-e578-4baf-8afc-be471c6a664a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327397, "uuid": "2cec2277-73e1-4300-97ff-c6efe1063a3d", "value": "7e4549de761b5bdb361bf22e3f3069539400448094c45d2e84175d76b6553853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c95d62cd-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785351638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351638, "uuid": "e4d8444a-1e6c-4d55-b1f0-a2d3136cdb26", "comment": "Malware payload", "value": "ab09f37e2e7f6b978f18c33476948db3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351638, "uuid": "cb84b685-91cb-4e90-b07c-fff5abebd70a", "comment": "Malware payload", "value": "8017ed65956d25fddc8834a24605bcaa6ec0c3070a61bad86ee57e5e4a2d04cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351638, "uuid": "fdaec04b-b9b5-4782-9fa7-83f6e4b2c44b", "comment": "Malware payload", "value": "9f5f905462298f20679f57ce39aa9d3bfc4f8fed", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351638, "uuid": "bf6556b8-3105-4abb-9295-a8e67ef2a9bf", "comment": "Malware payload", "value": "512ae72d2d7a1d5286fa1f6df527b00dd642af243e1fce72d7b4a3ec01e2f8e464874154e179fade02b3f68f92109806", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351638, "uuid": "00108f71-10fc-4d43-bf7a-4f1e18edf74d", "value": "T1C0C27C956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351638, "uuid": "4849e106-0f97-409c-8017-41add0bb6d92", "value": "768:W8vCB+25j6es8Rq9FYpMSUpi+20qUpi+20YQX:W8l25Jcd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351638, "uuid": "612ed17f-925f-4546-b9e7-bcc35107df0b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351638, "uuid": "f636c79c-b13a-4e81-89d1-fb914c6c8825", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351638, "uuid": "ab5c0a33-08d7-4658-ab29-84d5a61078c2", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dc463e-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785310633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310633, "uuid": "2f72f7cb-dc3c-40fe-b216-a6523e7b256e", "comment": "Malware payload (CoinMiner)", "value": "fa58c593485fa300fb8156646aa6a1ae", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310633, "uuid": "2ed3774f-beb0-4e59-b646-a3b229440149", "comment": "Malware payload (CoinMiner)", "value": "803b8565ecdec7a649d08f9ca48cb2a75307a87b36e92f993f5f5e615384ea94", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310633, "uuid": "1b3f0332-aebf-4454-962c-b7a413de6d8d", "comment": "Malware payload (CoinMiner)", "value": "0fd2ad888ab5884201af21331fb6e78394e09491", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310633, "uuid": "0761b29a-7ca4-4edc-b74d-bdf5e56df780", "comment": "Malware payload (CoinMiner)", "value": "762bbff0a74ea921c1c7e84ffce36abb6920783ae7b1f0591c18ea1559fae9d64647bcc01bea420bec3d25b22ccf1d01", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310633, "uuid": "b8247edf-2a96-43bb-8a38-d6f930c4e64b", "value": "T18C756B07B6A644FDC096C870874BD5A3ED35B8590221397B7684AB312F36F205F6EF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310633, "uuid": "aebd4c44-3850-4f5b-a0f1-46ac3c861898", "value": "24576:Rld/u1jXJ4Ep6a4FsBg2oNdgOr96WZSnUHmoTlNb8jEtH438ZEKUU/cTW+pPR:Rld21rCEcJFJXd30ZnwmGlN8gsR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310633, "uuid": "36b9e2e1-6b37-494f-a5b6-4802abb09d93", "value": 1695184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310633, "uuid": "38fa070d-872e-4d4c-ab03-e5847eaa3660", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310633, "uuid": "0881af8d-0f06-4561-bf17-03645fb8d00f", "value": "803b8565ecdec7a649d08f9ca48cb2a75307a87b36e92f993f5f5e615384ea94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339d7812-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354393, "uuid": "c4572231-af78-4a7e-a0ae-54fca97127a1", "comment": "Malware payload", "value": "5b73f3e8401225bb90f898d0aa41793e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354393, "uuid": "9a1d4833-d6fe-4985-a30e-d0601d247009", "comment": "Malware payload", "value": "816f1f4df1f3964c807ea3606a6319a7872b6de54dd9286c1fed4982d6982af6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354393, "uuid": "5629e11b-6070-4478-9e8c-4ad0883f3fe7", "comment": "Malware payload", "value": "0322d5384822d076c5c0ddc16ed8a661dc5ee782", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354393, "uuid": "b3319262-98ee-4795-841d-f81db9fa3342", "comment": "Malware payload", "value": "a1e541bcb8046198f7f16dc947deed80098d89116553f9622db286eca45db62ff740bd229b10cf7e17e3a04ac7ada9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354393, "uuid": "e78579dd-174b-47c0-a442-bccba7ccd13c", "value": "T197D46B6234D518D9C136C2F2CF97E1749713FC751DA0852BA2CD2E166F0AEA12D23AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354393, "uuid": "c74354f1-9f10-4d53-ab5e-93a44c606bc2", "value": "39e02ffded34b5af420a331c1a5785d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354393, "uuid": "1b3b583a-209e-47f9-bfa1-5c1b9d7fe6d9", "value": "6144:bGHmpYLsPpb38nw+6FBn83VZp9v34pR/xrYkVz9NRlzDJfLPcUz+AcAC+rNYjihb:iHGPK6rOjpl3C/x/Vpz16GjYjiF7cQ6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354393, "uuid": "8d8df4cf-7138-4fb0-a32d-21a1c5e53704", "value": 620184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354393, "uuid": "20ae9e11-e2d9-46a4-bfda-cc6b0420424a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354393, "uuid": "e22abbe2-eba6-4abf-afb5-f73623208f02", "value": "816f1f4df1f3964c807ea3606a6319a7872b6de54dd9286c1fed4982d6982af6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98844775-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307317, "uuid": "acb6fd31-363d-4555-9264-40db9755eff1", "comment": "Malware payload", "value": "121298528af04c49d69b0ddd8cd69e14", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307317, "uuid": "21a4d6de-14f1-46a2-ae2d-efd550b2bd4f", "comment": "Malware payload", "value": "81badb260741342daf5686ef603ca20bd28ac968588df0f482630200ec627f90", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307317, "uuid": "b17e82bd-e82f-411a-9f29-fbbe8c660c71", "comment": "Malware payload", "value": "36d976a90eb6893b70af57afde8c89fe6a038d64", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307317, "uuid": "4f5df70f-d3b6-4640-b2d2-0cf7d8724430", "comment": "Malware payload", "value": "ddaf0970660f841c6385863027bb5bf955b09ee63244cecd9c635e76c1e6a1642005a6cf3b3f366529d77c18a998315e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307317, "uuid": "f9e3ed32-a28f-468c-8aa1-cc67218a3411", "value": "T1AC22AE54278FADD8D161384A3754568CAF5BE5C459C24E22FE8954E89EB7FC34D0ECC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307317, "uuid": "32630dad-155a-40b3-9715-c5f555f06147", "value": "192:2DU3wwA/ABDm5h+0rA0Q0lEEmr/vanM3ZBUtsHAszH0fpnrBE6zLfFL:t3wwEAgjQ0lEEmbfZBUGgszH0f1rBE61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307317, "uuid": "34a9e56c-1dc1-44c1-b597-9756bdf78861", "value": 10883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307317, "uuid": "95a0a259-7a60-41ed-b187-df90c154b6b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307317, "uuid": "63dfc040-fdc4-4c68-9452-4b4ce859cda5", "value": "images_20260729_033019.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e03d899-8b6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785344612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344612, "uuid": "529039ca-9801-4153-802a-44a81a52a19d", "comment": "Malware payload (ConnectWise)", "value": "5ee603cde7f439488c0a84e0bfefa93a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344612, "uuid": "141ea9f1-54c9-4b44-9e32-56c6a7c5e562", "comment": "Malware payload (ConnectWise)", "value": "838a421db4e9ae25ebf41b3c3bfe50c08f89f76a654ee51dbbb617fe54e9f145", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344612, "uuid": "55dd523c-ae61-4af7-9a82-9d2c054503cb", "comment": "Malware payload (ConnectWise)", "value": "6c387dc46d93f793465c2a8e836b8edae5be7f66", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344612, "uuid": "3b057b77-3be3-4274-a2aa-5c92210a77d0", "comment": "Malware payload (ConnectWise)", "value": "a0b067a3277c17f6fbdd1c4fb5ce6f48c249502804efd3e0d0e51013aa134bc6b11fa9dcd2b89a5ce54e4ab3c4f0a32d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344612, "uuid": "a18d873f-f280-4f58-bf6a-48e5e2bcb8b6", "value": "T1E5D623156BF89278F1F22A35E876A0B1A5377C525E22D12E2324790E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344612, "uuid": "c627a3da-0ec5-480f-af93-6817377ec486", "value": "196608:aHxcp9ym3oltDUJVMHxcp9ym3uHxcp9ym3GHxcp9ym3FHxcp9ym3aHxcp9ym3NHk:oGpmpTGp8GpUGp3GpoGp/Gp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785344612, "uuid": "708347b7-e933-47a5-b438-155051606468", "value": 13529088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785344612, "uuid": "06b8a223-1697-4abf-b049-6109245909d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344612, "uuid": "402e9932-181a-484a-8264-5e2c03982f35", "value": "malw5500.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0186fc1d-8b1e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785309641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309641, "uuid": "87747836-3971-4fde-8971-adba257b765e", "comment": "Malware payload (CoinMiner)", "value": "0359f14d3199e0f7db5c724b47aa5b7f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309641, "uuid": "ce45a689-c7c4-4e67-9165-714849a4f64e", "comment": "Malware payload (CoinMiner)", "value": "84b41806926f1046b6e23b7b8b1f1665c095b5e68d8b73ce71516a4beebf254a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309641, "uuid": "d0c13f8d-e904-4579-aa29-15ad348ad28b", "comment": "Malware payload (CoinMiner)", "value": "8c9da4e9c0714e9eb06b796403e1736bbbfa15d8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309641, "uuid": "39368dbd-8de6-4169-968d-f86d977d4ded", "comment": "Malware payload (CoinMiner)", "value": "26287e55252462214bf0b392af23a9aeb1ff705aabf5cde8d37117e12b3da39a3c08cb0fc45b3e5b8ed8eb32e8cd816c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309641, "uuid": "10513724-39e9-4a24-adf7-b794da14e6b2", "value": "T173357C83EBA385D8C156C8B5534FF137F9627C8E4A157196ABC41E633E67B64E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309641, "uuid": "43d28587-e668-4040-9f4e-8204758187a4", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309641, "uuid": "0a574498-2596-48dd-8dcc-1c60c0593f75", "value": "12288:RZ+OE4MmD6/Oyspc5EEBBBHGBgzGerwGOvPqItNquB:Rcb4M06WpoPrwFvP3f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785309641, "uuid": "93de154b-d876-461c-be38-b653fe3788af", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785309641, "uuid": "741b5657-4c69-45f5-86a2-6bfe839d4e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309641, "uuid": "8f1a6791-91af-4d71-9523-1c5424b5d23e", "value": "Veax.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ab3576-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333168, "uuid": "c84638cb-67e5-4a7b-ada0-94c7badf2ee2", "comment": "Malware payload", "value": "b5730620898896df9ec8d1fc60fbfe4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333168, "uuid": "4c56ee48-0850-4a51-aaf7-1eefc6362ce6", "comment": "Malware payload", "value": "8539bb178bd466a933d77d27f895cd6d958b7bbf132b0484c4dfc46dfd485337", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333168, "uuid": "efc29584-27d2-4f42-824c-4c2e8865bd23", "comment": "Malware payload", "value": "f62593941aa3012ce9ef93c6e99f941a8ea223b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333168, "uuid": "11fdfc28-9bb7-43a6-88a8-649579d2012a", "comment": "Malware payload", "value": "8cf0ee5c63098021c5c4d0a4177b339758b90c8027f000dc878f4bc80cc4c5fc6652708a6cafbe8a2d28371ef62585eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333168, "uuid": "b50da105-93f0-481d-a68e-8f76f1a5c57d", "value": "T183C34AB3CC262F5CD565E5B0B0708F796B53A920928B1FBA5877C2B89043D8DF6057B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333168, "uuid": "6b1957b6-1185-44ae-9afe-3a23298242bf", "value": "1536:McYhnOIWi4h/ggSfVShCsKXIYt7+AxXeHTyvPUWpZOMB3n7bQ+QmO1:MLJI5h/afAhaXPDXeH2XUWpcMVbzQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333168, "uuid": "37db959f-cc4a-41c6-b233-6bbe82fc6896", "value": 124728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333168, "uuid": "12597175-dfe7-4e16-bd81-d14df6a7672e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333168, "uuid": "247ca32f-03c0-4441-80df-169b0ba1bb68", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28ff8e2-8b42-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785325373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325373, "uuid": "ab3ee508-7506-498a-b2ee-0dae0787f986", "comment": "Malware payload", "value": "0b586e68bf26b87ff96af014a8de892b", "object_relation": "md5", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325373, "uuid": "a5946e5f-c783-4867-bcb3-9e0c7429c14f", "comment": "Malware payload", "value": "85931578b4999670172dcd89d38fcf789e2327d9e6fbc7ebf47957d543e546dc", "object_relation": "sha256", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325373, "uuid": "6e43469a-f65d-4324-a0cd-ddd872f6bdb9", "comment": "Malware payload", "value": "2a9fddfc97ce5627216ba16e6b49181880da9049", "object_relation": "sha1", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325373, "uuid": "e7fc1b7a-c813-4580-880b-5045091534b8", "comment": "Malware payload", "value": "41ea559d65b060838f5123d544d8a05f7bc87b927dbe4c20f8f0aa1c2df693e15402fb0b467651e89e01a5feda232d30", "object_relation": "sha3-384", "Tag": [ { "name": "45-94-47-226", "colour": "#2066CA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325373, "uuid": "686795ad-547c-424c-ac54-16194eb7d9e2", "value": "T1BCE02642DF005BA0FC5FE27615D029C77BA081348064A12E02B776BE0C24AA08F0A992", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325373, "uuid": "32fc2d3f-c719-4e9a-b516-6c3bb904a219", "value": "6:5jOUT3l/Dn7DVkwsFG57DWNHoLmcq9KtmUT3l/cGV7DVkwsFG57DWNvlI/6nt+l8:5jBlLn7D6wsA7DWNHoCc8ilf7D6wsA7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785325373, "uuid": "e5aefe23-3d2a-40e0-837f-4d15fb2f5e02", "value": 352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785325373, "uuid": "2a8f95c3-53e0-41e8-94ef-6585721b2eb0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325373, "uuid": "21e1e26f-9be5-47e0-9394-72d6cf3e5ad0", "value": "3437adbf90dac02f0d5657e7422925bc191957683c7cc7f8d0b37ec4affee8e8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc85af3c-8b97-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785361951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785361951, "uuid": "16df940a-aca9-4ae8-af98-5328d9b3694e", "comment": "Malware payload", "value": "07f8e0b9aed8eb0806104303d40aaca2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785361951, "uuid": "d3d3da86-b6d1-421c-9a7f-e87c1aace012", "comment": "Malware payload", "value": "86dac88668ac7f20317d657ee7e95aea8a9df3530ff2713f8d62557e381bbec9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785361951, "uuid": "89b50b54-1026-477d-961a-72f7ec84a862", "comment": "Malware payload", "value": "36d174663ab2394e4533c6cea997e24380db8921", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785361951, "uuid": "c1ea5a2c-ee51-4f71-8770-a6359797496c", "comment": "Malware payload", "value": "74591fae966ae822df0e3583a87245e266b5c940d13d2ca1e8a6123d397e838ad929e8234f373a0a5ef1b9c03128f600", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785361951, "uuid": "21990e09-7337-41f9-81d2-73ec4c267771", "value": "T1EBE63308AAD123FAF6738338EDE2549AC52DB86603B2C5CF5B8487915E171F18D7E253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785361951, "uuid": "27e3dd40-0fbe-440b-889c-0c34c2cf51af", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785361951, "uuid": "6aee45cb-1703-46c3-bce1-0ecc5ff3e819", "value": "393216:k6PdOEu7yj5ZT92Xfl2zpXMCHWUjXscuI3/PGTAI:kcOE8yj53XMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785361951, "uuid": "4eeba362-e5d5-47c9-aaf3-4a023c5478a4", "value": 14315651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785361951, "uuid": "76580ac5-5ca8-43ec-912c-bf00f23fd7c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785361951, "uuid": "a9b20bb1-a337-4220-883f-a0452fed7ace", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7b1290-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351829, "uuid": "236bede1-cf63-4ba0-aed6-dd0f577a4319", "comment": "Malware payload (Mirai)", "value": "53489d293645cd5d5d15dd0cbf4443ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351829, "uuid": "fffa221d-e863-48e3-b438-1ddb729249aa", "comment": "Malware payload (Mirai)", "value": "870f422bb0b9dbcf78765cd258372dc44268ee64d46e074f466c064ffe88f3b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351829, "uuid": "4ba1b643-fc66-49f4-a952-37ae1a1323a9", "comment": "Malware payload (Mirai)", "value": "fe5c29cd24457c317492573bc6d3ad5aa7105b2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351829, "uuid": "d83aaae9-a023-40d7-8e07-3df77863363b", "comment": "Malware payload (Mirai)", "value": "63f9d60925c7bb9bbf0b990c3e6143bb9eed7153959f2f8066b31e36ba14fdb645600778bb67b1ac275e5afc74d514ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351829, "uuid": "1df67f35-3b0f-4937-a26b-0a7468e455fb", "value": "T1FA041B86BC818B01D5C616B6FE1E164E37135B78E3E972039E146B393B8AC6F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351829, "uuid": "0735fbb6-656d-4ce9-9480-bccae0d9b1c2", "value": "3072:iGZLg905FVPTBToLmpMguHcUWVUHalw7W5uH0AsfC95iPUnGYSWXGB3ER3sBKBgM:iGZL/hoLmpMguHcUWVUHalw7W5uH0Asw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351829, "uuid": "5800efd7-d0c5-4bf9-97ea-bdcd46503efa", "value": 177212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351829, "uuid": "9dd87c24-02fc-4f8e-80bc-787d85120110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351829, "uuid": "9d6b484f-d459-4186-8f76-bea32d73bafa", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6528e3d2-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350610, "uuid": "af7cf165-6644-450f-9b66-f8535caf0aa7", "comment": "Malware payload (Mirai)", "value": "ee9ba02c552418c8cb00e235ac2bd5cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350610, "uuid": "662ef84f-d59f-47ae-bcd9-a32437d5a6d9", "comment": "Malware payload (Mirai)", "value": "8778196f7d3c9c18eb0d50236e52c814f735549c5aa00de3bf70bf1c1398db75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350610, "uuid": "c82b5571-e696-4cab-81f9-6598a2531e91", "comment": "Malware payload (Mirai)", "value": "f8bad6dff2829a768f80c1e36b3c73785410bb9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350610, "uuid": "a19b7387-dba3-429e-bdf2-0882a65f1e81", "comment": "Malware payload (Mirai)", "value": "87819f58c306a9e5f3b3a553ceea420b22c81976f2f4465d27dcb64dbd985c61fdd3119718d4f7e05e28b44809c77057", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350610, "uuid": "b1322915-d5df-4c9a-a337-bb774bd6d8c5", "value": "T1E7E2D167C2DDCA50C26A83376C776C1BA84891BDD19CCAB4BFDD45736942FA27C26310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350610, "uuid": "38af798c-d32b-4397-85bb-b13199c17aac", "value": "768:eII/femiz+uCGq4uwZMLfFWOG2iPujUGdnbcuyD7ULWykkAL:eIIXemiauCsuw6Lf1TiPuIGdnouy8LzG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350610, "uuid": "14604e22-11cf-4bcc-87c8-c96ebc886628", "value": 31264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350610, "uuid": "bbcdcf27-f4e0-4751-8f92-b8604777ed63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350610, "uuid": "d6d8cb0b-c144-4d43-b93a-061d55b8d14b", "value": "zero.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e409a85-8b26-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785313152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313152, "uuid": "63f9607c-4e97-4ff3-b609-decb827240dd", "comment": "Malware payload (ConnectWise)", "value": "8fdc02993d546080944d078da149d503", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313152, "uuid": "0fed4c75-2669-44f7-b10a-346269917c0b", "comment": "Malware payload (ConnectWise)", "value": "879617884d18a22bbd36afdcd7bce133f1e1cf92471fea46c7632ce40ca3fa56", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313152, "uuid": "096a4a74-d4e3-4356-bdd2-905e9d2d494f", "comment": "Malware payload (ConnectWise)", "value": "9464c8426b47711a47c1864eec5f7bae7cafc8cc", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313152, "uuid": "5a06c517-b733-441b-9374-d0abedfb266f", "comment": "Malware payload (ConnectWise)", "value": "79da2d721bdea696f949cded0f46528ab26c691500b1d19f6d949d22414accfaf7f851454245c75652b2e680261de18a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313152, "uuid": "52ab7bd5-cc86-4cbb-bbb1-53f5cd5db508", "value": "T1F2A6233267E8D425F1B60B3AEC3A86B16A39BD10DF15C40F2364784D6971D81C6A37BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313152, "uuid": "1d6bf66d-83ad-4434-9f6a-201d2ec65041", "value": "196608:Deq5KqDBCDkStXQEneq5KqDBCDkSt3eq5KqDBCDkStAeq5KqDBCDkSt:Cq5VDBCDxXQEeq5VDBCDxOq5VDBCDxdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313152, "uuid": "82c792fe-e3eb-4647-a79e-186ce8a849a8", "value": 10227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313152, "uuid": "5b0df08f-ae47-4a47-be9b-caae06c96749", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313152, "uuid": "bf76400d-fb65-4331-856b-659767dd51a3", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d92ec3-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351422, "uuid": "0276d9f7-143e-457a-9424-9149e8fb8ca3", "comment": "Malware payload (Mirai)", "value": "a79c87817183550a7b4c272d8999b587", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351422, "uuid": "7bc24b68-4b93-4616-a9fe-5ef404cd4eed", "comment": "Malware payload (Mirai)", "value": "87a4e8e1c1056ee839eeb03f5108c87ea9bc4b9bce220ab5002f2853b26044b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351422, "uuid": "199467d2-1d62-4440-86fa-bfa6921a1e9f", "comment": "Malware payload (Mirai)", "value": "9baa082f55c9bf0fb5c1c4585d015f78a81d35d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351422, "uuid": "0af48a7a-e2da-4334-ae48-a41e6edf70de", "comment": "Malware payload (Mirai)", "value": "9116ef860232fd7be165ae5ce8a7ce9be9dce5c7f234588aab232b55600e245862f1aa18b20ee2a1a3103a6cfbc0c624", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351422, "uuid": "6483d6fd-c35c-4415-833a-0698e9514bb0", "value": "T1EAC30659ED416F01E5D635FEFA4F028933531BACE3FE7212AA245B2123CAA5B0F76501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351422, "uuid": "129a731a-4313-4750-9192-4ac8475361a3", "value": "3072:vSul5uyN/dY3LgkvKj72WaUNIdiWmisfTCfQJbQ3mGJdY:v/AsqskSPpaUWdiWmiIwQ1kmGJdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351422, "uuid": "e1eeb89d-46a5-48ae-baed-d256c17a740a", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351422, "uuid": "f59267b5-770a-47a3-88aa-38e0db6a58ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351422, "uuid": "f1c9b18c-2e49-4de0-9113-f61c3273a5d8", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b7409b-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321370, "uuid": "31bdb784-d215-4237-aae4-f91f09967949", "comment": "Malware payload (Stealc)", "value": "0121b38de05462d8e1ab8081f3d76f04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321370, "uuid": "16fa067b-1a3f-4667-8a1a-1807938ad060", "comment": "Malware payload (Stealc)", "value": "8802527c317068b4b824d7bc1843dee0e52e047c7fae4997d577c11349c1ef01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321370, "uuid": "49f22f73-9e65-4cbd-a482-fb91149c7099", "comment": "Malware payload (Stealc)", "value": "7a376e7ca7fb7efe2cfa9b3efaebbbf1495db0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321370, "uuid": "f248a631-ccbe-45ed-925b-d09306a08468", "comment": "Malware payload (Stealc)", "value": "60e738866153ad62887180a951b8c1020a5fecf133e209bedfee94a338d347e5645435defd231db67cb4830b7d70f26c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gamespotworld-com", "colour": "#87A9F0", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321370, "uuid": "ca1e9e07-1f4d-4c3c-b964-63c5910b0c34", "value": "T17C057C1AF3A502F8D17BC178C9424562EB72B8565330AADF03D15A6A1F376E05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321370, "uuid": "d70c5d16-233a-4233-8183-dbe894925f09", "value": "e9dd64dcce15e249bad873d9dec07f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321370, "uuid": "e36e2a31-ac41-489f-b622-36d51625fd7f", "value": "12288:yg9ANYPuw2vX753/llDB/CjE+HSDdOyxBlDetAqxSv9Kj:yMAqv2vX7RXBqjEGGdOybe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321370, "uuid": "8f021802-e710-43c6-ba2c-371b73b69996", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321370, "uuid": "f3a0a646-ff00-4adb-bf53-3ce15e29ac26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321370, "uuid": "1c68c7da-7729-446a-b97e-ab3516e2a808", "value": "8802527c317068b4b824d7bc1843dee0e52e047c7fae4997d577c11349c1ef01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c86421-8b8a-11f1-bd95-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1785356406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356406, "uuid": "82765a3c-9232-4ac2-be70-1c0951f7fb88", "comment": "Malware payload (NanoCore)", "value": "2c5a9aa5ca5b6d98a5551da0ec0be9af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356406, "uuid": "33081cef-08cf-4cc7-9791-d84362786743", "comment": "Malware payload (NanoCore)", "value": "88536cf7df49585be4aa97e938b5ef5b5ccc46abbd2919010646a9a17281e3b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356406, "uuid": "4186da3d-1b8f-4dbb-a2f3-55734d8ce24d", "comment": "Malware payload (NanoCore)", "value": "b6a9ba6fdc95dcb5e78a5fa50a76f32f982b3125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356406, "uuid": "59d2f721-dca5-4557-9ee8-39fe775f1998", "comment": "Malware payload (NanoCore)", "value": "1754fc1867575122b6f18cf99cc168ab848f54dc7d5f27e6693583e6ac2d834ef5c93e0c8bded2ae406dacfcf9f272dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356406, "uuid": "5c883e87-4557-48d4-b811-f47be8139da8", "value": "T19914D0563BA84A2FE2DE8579712212139379C2E3E8C3F3DE28E451B64F567E50A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356406, "uuid": "ee64da1b-fceb-49ad-bae6-50f11f118a36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356406, "uuid": "527f38b4-55dc-4522-b822-1a7f94a5c57a", "value": "3072:szEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI/1sC6wwBLsjAIZnB/nFgMbszD:sLV6Bta6dtJmakIM5O+LsjAcW/zhIRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785356406, "uuid": "f3f93e69-8e7a-4f94-8bdc-5b5b4c8bd915", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785356406, "uuid": "ee29c701-a643-4436-9061-119a1a4c97e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356406, "uuid": "9d63c583-97d9-473c-b130-0c550e51d999", "value": "2c5a9aa5ca5b6d98a5551da0ec0be9af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75031d52-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333028, "uuid": "9047001b-f559-48f5-97fd-70cdfc83bfe1", "comment": "Malware payload", "value": "6018cd1b66d23b2923c6abae494f9d95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333028, "uuid": "3646b737-cc29-49bb-940f-ea4c6485774a", "comment": "Malware payload", "value": "88a267bf0eb21b2dfec2e7320af2b34f110a90979b1481a0ace0a2ee9dd4c68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333028, "uuid": "293a24b8-1e9d-4c43-bf0f-81cbbc5679c9", "comment": "Malware payload", "value": "f51fbea73e2d7db4e00c80f2044aed3f1ce2a939", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333028, "uuid": "01354325-bf85-42ba-97a4-5c1954aa0b21", "comment": "Malware payload", "value": "d840362bd3c4a0a21523a3f3c77eb72ac1246594da65bbc9327d74cf18200306b3a6f7d7337a1eaf7b54dfbbe63282c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333028, "uuid": "a0683984-10b3-4f58-b8c1-aebbcd8918bb", "value": "T186E39FA3B70F24A1CC2709F417C7579D2A3325008F6BA9E66C7E363A56366DB29077D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333028, "uuid": "93bf37f1-8e74-40a9-b3a8-1e166777b55c", "value": "3072:jsPaZRJtSPIo2oqW1S3lSnvIRHIQ/ZKVgvag6CFfbKJdKIJhq:jsSZRnNozScnvE3USvGCFfbKFJhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333028, "uuid": "ec2744a4-e8db-4709-b651-a425ba24358e", "value": 157144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333028, "uuid": "0e0d7b40-e5b6-43dd-9799-8881fd7a5615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333028, "uuid": "6a96f4fd-2123-4486-a2b0-8dd3e727be63", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be242c05-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785333150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333150, "uuid": "3ad6457c-c8cb-433e-90e0-0e6e771a4746", "comment": "Malware payload (Efimer)", "value": "b01bcc20137e6cc6683881d70eef7815", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333150, "uuid": "cdb24518-b1d1-4d11-b595-93c5dea63939", "comment": "Malware payload (Efimer)", "value": "88a809fd0fbcfe06987d6c3ec704c78f0c5a1d83aee1ce8b54954d6a6a9d6f87", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333150, "uuid": "f6b32fc5-6831-4b15-8870-71ccbedacd31", "comment": "Malware payload (Efimer)", "value": "0a75d1cfd95172aa20d75a4fbc67952b8aca1ac2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333150, "uuid": "4e50071a-29b5-474e-80af-3ebb57a9a0f1", "comment": "Malware payload (Efimer)", "value": "ca7117b5246f063f325ef5a52a044f0ae526ceffad03714b9d7b9f36d9315aaf6f071de76d4b996a5eda8fbef22b8f7b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333150, "uuid": "bb2cf0bf-aa1d-42d8-b80c-842ae2c4411e", "value": "T138E6336C6BE012EBEAE7513CED932691D0B4B4671372CD9B1BE883A52E171D14E3D213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333150, "uuid": "fd4bd00b-0bca-456c-8ba8-f754aa36389a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333150, "uuid": "73012958-7097-4318-bc4f-9f8e56e0dd16", "value": "393216:6dzs3wbzzulfPvPZFmXMCHWUjXecuI3/PGTAI:6dYgbzz83vKXMb8XTH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333150, "uuid": "bcd04b5f-8642-461f-95c5-9d8a35851b34", "value": 14314041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333150, "uuid": "295537e8-1abf-4342-a942-50cfae0a9bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333150, "uuid": "3a91ecf2-43f0-4f7a-b4e7-4d6e09ef8a65", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab9acc2-8b21-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1785311079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311079, "uuid": "47b6befd-aee7-4505-91f3-177ca3f6e564", "comment": "Malware payload (Vidar)", "value": "60932f44b0fd6a7d26f62add70bbb45f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311079, "uuid": "506a5513-ed13-4481-af24-fd2aeb4c56af", "comment": "Malware payload (Vidar)", "value": "88de646b346b25c8bb1ad21ce2884499e9281597122d91162248e10bd7c935dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311079, "uuid": "04125f9d-a912-47e8-84d3-e10ab79b135c", "comment": "Malware payload (Vidar)", "value": "062d320071f540a47192afa993da75259614142e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311079, "uuid": "fa6bfbc5-ead1-42ce-b362-a8deb2646334", "comment": "Malware payload (Vidar)", "value": "37762ef336e6bc718e72e8c002ce780b58e7040bacc113b93c6a560830f7d5ff8eef129d19e0e2e6d0df65bc9d0e1a96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311079, "uuid": "64e80ee0-5b2e-4fde-a99f-d5ef14e97750", "value": "T1D2269F4BBCE26565C49E93358D721240772CBC474B3633E72EA0A6752F62BC2CDB4B94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311079, "uuid": "48ca0ded-52db-4075-8499-79007aadd150", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311079, "uuid": "ff2e4108-89b6-44d1-95d5-d94848d0f6dc", "value": "49152:YE8ui5ySgZqwu+EuYbI0qFsFtzpEq6k9cVQJYTCh5YvLENXBOulK0E3R8lXs7gWv:YEo5wgQYf6Fn1oZ3vNBVa1uMGaP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311079, "uuid": "22100d12-d217-4a90-94d2-dbaf4dd20525", "value": 4583648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311079, "uuid": "82d85d99-e609-4ef7-85a9-32fac82dcc6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311079, "uuid": "8e18f4db-24e1-41ea-9239-50ca44c3b715", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95968d8-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350430, "uuid": "56ba28e1-d9a3-4247-95e4-32f7abe1f174", "comment": "Malware payload (Mirai)", "value": "3da0de4574b375deec049ea9b200d1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350430, "uuid": "229cbdb4-eb2f-49c2-a314-73a8f1a91d91", "comment": "Malware payload (Mirai)", "value": "8925eb6a43dd4cc79cbfc572cea2ef4359c6d19e90429b1f0ecacdf483c8b2e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350430, "uuid": "e3df3d76-5dd2-48b3-8498-3120341eedeb", "comment": "Malware payload (Mirai)", "value": "a46ef1e7c752cc069516a0284900a7742d6ea662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350430, "uuid": "36fe0a0b-4a7f-4a27-82c1-e322b8a68bbc", "comment": "Malware payload (Mirai)", "value": "da1fa0d13d9e171a9cdadddff9cf5dcb7b85751d3cace6e065e6bff7914bb2abd373acc6a5ca68981a33186ad2987431", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350430, "uuid": "fd3d0bc6-dc21-4fd8-b6a6-a9d8d9b0f5ee", "value": "T1C953019D23A4BCD2CAEE147881C51B91ED92F9D823BE890D0740DCDA856951EBDEF0D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350430, "uuid": "3e5559ff-a9e0-4338-b232-94da0b5727ad", "value": "768:HC+Nok6wGw/27RaoNy1sFT0PPfj9CRCMsG3T2KY/mLpDYRWBAwPQrddZPsm+TyFv:iWu7R0v3phMsG34mVcVrhPsm+WwnLVva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350430, "uuid": "58ddf9fa-21e8-426e-b964-46c800095a9b", "value": 62188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350430, "uuid": "c749eca2-9964-48d8-9961-ea6b7f07f47b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350430, "uuid": "28015628-d687-463b-ac6c-fbeb76dd9273", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bd897d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324603, "uuid": "c6c6f6e9-fd9c-48a1-a463-9b170ffd5b20", "comment": "Malware payload", "value": "2615e39d150e0b6b304b5303b40c7a61", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324603, "uuid": "1274f6e9-ed12-44bd-a981-af55ad608e1f", "comment": "Malware payload", "value": "895f80a5fa6b4a2f4f4446f4ec6ce464dc14b45883a2b41878c777a56adeb21b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324603, "uuid": "e5e7353e-581d-4238-afe8-73c8dd753ab0", "comment": "Malware payload", "value": "499e8dbf641eb321901bbb0651b7bd87ad2e4f34", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324603, "uuid": "157d7377-7851-4274-b315-f65564d4c2fc", "comment": "Malware payload", "value": "41352a81aaf6e117f5c40928e9ed946435685bcfb25796c5bc08b6567f694d8a379505031117088adbb9b9e3e4b0f166", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324603, "uuid": "f0601143-7fa5-4232-a886-a6b84c9a0d3b", "value": "T18C21D8F0777C1366EB0D73B07FD6506B2075401D2952D9E2E852966DE04BDB482CB2E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324603, "uuid": "a803396c-b5fb-43a5-b1d7-9a62cf842202", "value": "24:9UwNDEMZMUhgbIvNzkxbTa6Ka2d22/HmkWMhrwUE6FIxX:9U8QMeUbvN2Ta6ufTfD9+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324603, "uuid": "e2365f1b-8e1f-4184-ab02-56a21c89b9e3", "value": 1368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324603, "uuid": "1959bf2f-ea89-4947-ab44-9bf3f986888f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324603, "uuid": "e20b04d6-e819-4735-ace0-b3c82ad170ee", "value": "photov_275121676585.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2478158a-8b51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785331604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331604, "uuid": "8a2e08c9-481a-4b92-9979-5df204bc2437", "comment": "Malware payload", "value": "71d2ff4525f545124ad088b266f6ebf6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331604, "uuid": "79aeffd4-2afd-45ad-949c-7a55f58e3857", "comment": "Malware payload", "value": "89ad58a61c6a774c0b66e5fba4a0e7fb83018ed3c27d7d82b910c19f55b41975", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331604, "uuid": "30b4dee5-c1c6-4c9a-b209-1fea3bb132fb", "comment": "Malware payload", "value": "70329b4d3a3d8353011408432d6a6c1993a16c3f", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331604, "uuid": "38f6a731-2005-4fc3-b2be-a28d573a98fa", "comment": "Malware payload", "value": "ca2690c619e427aecba93fd857a135807f6e400b8538677ee3ba1969a58a2e174d2a9ab2264d59a095130491ca016be1", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331604, "uuid": "0a4abf4c-3e8e-4439-837e-8f08e13da14f", "value": "T1C45187BFAF1CC33009923A6742D58C1DA02B4FABACD19880A15FC41E375577646E6C5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331604, "uuid": "4f352e0a-190d-4553-a8a1-ffceb84e7bb8", "value": "48:EwC/DXYy5qbWsj3Rov2AjhUsacAsh0XuWqBR6ATdARwP:EwC/DXYy52BlUIuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785331604, "uuid": "92581699-9ab0-4df8-9204-caf2cd925825", "value": 2628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785331604, "uuid": "a2c24044-a571-4781-a90d-08f3fa01c20b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331604, "uuid": "b0b81672-b812-465e-8abe-f460c3ccf476", "value": "Doc6754321-36265.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec10aaf1-8b00-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785297150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297150, "uuid": "b235815a-9356-412a-95bc-e3bfd0008637", "comment": "Malware payload (Efimer)", "value": "b18dbb4364eb84c4fcd6e405006d2fc2", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297150, "uuid": "0539bd5b-c55c-4dda-bdec-9d99de21398f", "comment": "Malware payload (Efimer)", "value": "8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297150, "uuid": "88536c92-79e5-4722-8010-2e8bc6fd1d76", "comment": "Malware payload (Efimer)", "value": "3e3c72a35aee2040bc517bd90ff3717b68c7cc2b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785297150, "uuid": "02b4e265-b7bf-4245-a376-f99cec8b8952", "comment": "Malware payload (Efimer)", "value": "e56d80a223715a2f9dcf524d61907b0cdd3c4819ce8d4b57ef70fe5e28ef735440ca5c8f30002e88497760129e35e95a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297150, "uuid": "b0720f8c-8875-487d-abbd-cde4c7e9b49d", "value": "T180E6338CE6E401BDE2B3523DDDD165F5D17674A603B2C1EB1BA48291BC2B2D18E3DA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297150, "uuid": "b3bc5e30-80b4-4997-829b-32f82368c949", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297150, "uuid": "e3a450fb-6151-4849-bdd9-c0ef9980f111", "value": "393216:0q7JQ2bNddLQtx/vm5GVfzHvi0XMCHWUjXycuI3/PGTAI:0qtjbNddLQLXVflXMb8XPH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785297150, "uuid": "9fcfdb0c-541c-48f0-9c05-b8d45ebec816", "value": 14306167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785297150, "uuid": "d1d42f70-7fad-4303-b3fa-3d686128b476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785297150, "uuid": "f44a3748-94a6-473a-be79-b33876af5827", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd72953-8b43-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785325956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325956, "uuid": "760ecbb0-c28f-4776-94eb-8e039693b0e9", "comment": "Malware payload (RemusStealer)", "value": "2e957df212add29eeac4d567c6ddbcb9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325956, "uuid": "8592f71d-2f80-44bd-95a5-d75efd094cec", "comment": "Malware payload (RemusStealer)", "value": "8a8857de50c2170ca7af40786168a6526e8190e297ec55e3d6a71fbfd21c3b17", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325956, "uuid": "cb2bb116-94a9-4b3d-b0b1-1f83cdc297af", "comment": "Malware payload (RemusStealer)", "value": "3c3fda68b6d423f2d6cf42c2253e576e4e793bd6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785325956, "uuid": "20677993-81ac-460b-954d-05ba4f2faf62", "comment": "Malware payload (RemusStealer)", "value": "583dcb3e0e734c406a438b97ca9e70551bf633286319ffac0cd315d9d8952d37c3b04aeace65272eb377906e7d98fdab", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325956, "uuid": "087a65ca-4ee2-4ce0-9813-d557968b5936", "value": "T102C56B07BCE148E6C4AAA33189B316457B71BC481B3623E72EA0B7782F727C19D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325956, "uuid": "461d7760-7013-4bb6-a749-b81e927e0fbd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325956, "uuid": "8cf9158f-36a5-4f1b-9d2f-0020e45d195d", "value": "49152:IQBYTVXtLbeVnPP6RcUgiFn/rd5pxIiZS+ChtELIVl0XxqY3HWKhH0IIWscaLWm+:IQwnuIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785325956, "uuid": "a4c153c7-aaa1-48fe-94ef-feb761dd6c6f", "value": 2661720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785325956, "uuid": "9c03599f-81fd-4eb9-b0fb-be0fb7ab995e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785325956, "uuid": "70ce9efe-a5c0-4572-b950-5e3b72c3ca4f", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f15d67-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324466, "uuid": "93bd3cf8-7e39-4895-ab83-4ac1be212914", "comment": "Malware payload", "value": "f89c5002eaaf4fbc469e18b497497843", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324466, "uuid": "e78fef4a-1ee1-4aca-8b2a-cc879ffa30d1", "comment": "Malware payload", "value": "8aabfc48f8ed6b2a05ba183660e44587a7ed71b4f5dbfc9438a3d177c70ee63b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324466, "uuid": "b7ffec80-a21b-443d-93e0-e71101cfbedd", "comment": "Malware payload", "value": "fffa8810ae1638e33e6385484cc0eb68ab3a7141", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324466, "uuid": "48990b98-78a3-4a75-8411-fc2ed32941b0", "comment": "Malware payload", "value": "d549b4f8cbd27f78d0352a5f4a418b52ef31305afac5d22e187523f5b0a2873bfbd156e8a6bf890af274ab2ec45a5e22", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324466, "uuid": "72b8591e-7835-4fac-b99d-0fde4cb57e2b", "value": "T1C221DB3080A9E294E9E1CE74B3697B1F3F02E93011471DE75F672DC5591BD09070B10A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324466, "uuid": "ede65bc9-c092-4a3d-a3c3-5c338f29e82c", "value": "24:9zVoyvlBdNefQ59gHfHfyAPBNISOMwhrhgmkLtubjHjT2SJm4oTFUzrlVpX:9zRvxNe4faf/yAJNMFr6TLIbD24Fo8rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324466, "uuid": "d7c3d9f0-b29a-4c91-b65c-a1e3a7fbc419", "value": 1427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324466, "uuid": "8071aa04-28c2-4ac5-843e-6aba82902be7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324466, "uuid": "2d9342e0-4ebd-4265-aeba-0079cf4515ee", "value": "photov_758297625492.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b9f205-8b0b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785301483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301483, "uuid": "73820ac5-a0a0-4abf-a794-04b9d634f6da", "comment": "Malware payload (Phorpiex)", "value": "6e069e0b7f208ce9a5e060f650575bb3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301483, "uuid": "ab26a8b0-5f8d-4c07-a6b8-0ba34105e058", "comment": "Malware payload (Phorpiex)", "value": "8ae5d15c1784e3462020a6784a729a8f2540e7433dd1b18d5d8c589da3358e43", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301483, "uuid": "be4aa519-9959-4678-b0e6-283a2f6cbfe5", "comment": "Malware payload (Phorpiex)", "value": "5baec0570af2e9ae1c7b1cb77b22040d91524113", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301483, "uuid": "c0a5142e-32aa-42ca-8754-3f9b26b69a15", "comment": "Malware payload (Phorpiex)", "value": "35485b6b9ac41b1359e28792efbc634ec3f42f71cb838825cc4dfbbf958d935fcda1df55502efde0cdcc5fd6bcf3eb4e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301483, "uuid": "bcb4e650-7a2c-4797-9186-e745439cbbcc", "value": "T12C822A0FB8424316E1D110B4967596BBD9B99C7633C418EBFBD44AEE1A686C2FC3250F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301483, "uuid": "fe97b548-a801-46ea-b5ba-ec9a8392edfa", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301483, "uuid": "bf912b7b-45b2-4d5d-b3ca-6dc797b62ed4", "value": "384:A/GZbmsmBTQU0Vu94gXTPuav8U9c+j4P:aJ0w9aa0U1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785301483, "uuid": "f9277184-f587-429f-8ecf-0412fbf439ff", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785301483, "uuid": "694d8951-d818-4605-9589-e3c091a3338b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301483, "uuid": "d2efb62a-3bc1-4d6e-8837-46a12f4f5b57", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdb3034-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323887, "uuid": "47899f73-89d0-40c8-b510-d58b8f0cfec3", "comment": "Malware payload (Mirai)", "value": "b8e07fd41e119fedb3f4bc1fa94e81bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323887, "uuid": "785fb05c-801d-4150-8bfb-e893f41ec5fd", "comment": "Malware payload (Mirai)", "value": "8b411ac80e787590b787d87f1e96814eff9c27a0284ef76f0d95ad9367171be7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323887, "uuid": "360b0224-3d00-4c2a-8cbf-942375d2aa3c", "comment": "Malware payload (Mirai)", "value": "d8991a8ac134d192f846c2fe19ffd5326c3ed334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323887, "uuid": "a7a85dfc-748f-40aa-ba33-b94620bfbe08", "comment": "Malware payload (Mirai)", "value": "5be3f4de413479ccdfede43571652058e3129211b00e892e71099f0c40e4d13d31f10bd3a48205974fe76e5c3543df7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323887, "uuid": "3b86a134-ec86-4c1d-9878-b7068ff148cc", "value": "T16E834B0173644F0BE8AA0AF5282F17E483FEED9011F4F5846A0FDB5A4635E37255AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323887, "uuid": "42db6f7f-ed62-4981-8b86-5dd2be808746", "value": "1536:XT4V5QNKvnu1rK3k6UHhOEBSemtXVmecGXV6u:X0VYk3wec8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323887, "uuid": "d9d46e6d-b90d-4c59-9f62-6dc6bb518006", "value": 83040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323887, "uuid": "547cc5a5-32c0-40a0-a994-98cee3900f27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323887, "uuid": "d45d225a-789b-4425-854b-b152233b87bf", "value": "MMaaRRiiOisecTanee.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4386151-8b1c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785309162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309162, "uuid": "269813a1-80e6-4291-8e55-fc71fd7838f0", "comment": "Malware payload (Phorpiex)", "value": "4afc3d22fac2f4c720dd63e3c03cdfe9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309162, "uuid": "4003bea3-a12d-4b77-bc35-dda5fcf5f5d8", "comment": "Malware payload (Phorpiex)", "value": "8b77fb002e30e9cb667858d0f08e2c5c12ed450aca0d7293ecc092d639bdd1b9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309162, "uuid": "6fe9bc17-5e42-4c3f-870c-ce7c62958781", "comment": "Malware payload (Phorpiex)", "value": "626ca03d0c5dae25d4763d1b299725d41a34febb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785309162, "uuid": "ca22857f-ddbc-43fc-811f-73913ac6f4ba", "comment": "Malware payload (Phorpiex)", "value": "3eab9784ae3599df58af81a97f96cbaac0b3b3dd306647e0b8b1a42afd34b3710723910aa7657ed28d77bbe041fc3b85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorphiex", "colour": "#A3737F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309162, "uuid": "9a711a23-9a00-4e93-89c0-3c94d8d27c49", "value": "T13D823B0FB9424316E1E110B4966696BBD9B99C7633C414EBF7D44AEE1A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309162, "uuid": "19845bdd-0363-429b-8bfb-65ec7f8b340a", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309162, "uuid": "84abf96b-e54a-4627-83d1-dd25eac6e4c0", "value": "384:ATZbmcmhzcEUaUu94gXTP+av8U9c+P4P:L9UaF9Ka0U1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785309162, "uuid": "8e5a5da3-28db-4206-9432-8e0476a8b392", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785309162, "uuid": "ab1e2101-ca97-4899-b5dc-c780a2ea8660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785309162, "uuid": "03a9edd3-d8a5-4591-96bc-61fd610aa7d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c7ee6a-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354403, "uuid": "082cc68b-f393-4bb0-b814-aceb7e27be85", "comment": "Malware payload", "value": "e03f4c8c1facef9dc3148bf534fb50be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354403, "uuid": "5934b6e0-7389-4214-b0d3-f6344fa62a14", "comment": "Malware payload", "value": "8d0c4a2565d38c923a50bb5daf512a7b80633643c65b5464d665e5f71b8fbd55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354403, "uuid": "f12f52b2-9d51-4b5b-9646-578b1749ddf6", "comment": "Malware payload", "value": "5d2192bba4949cb6a02ca08c59e282a60f5bd7c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354403, "uuid": "91d25c7f-3e4d-4ce3-8564-8d8db3c767b8", "comment": "Malware payload", "value": "f8776d75c960f980f720f0bd83b0818e5d9038ae6d3ac413bbf1fe724719dba05ca010e1d6368871b82d5457a702d709", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354403, "uuid": "0bfa2b84-f4ad-436f-96cd-30c2772bd4b3", "value": "T13AD46C5239D5189AC13682F2CF93E1749713FC751DA0852FA2CD2E165F0AEA12D23EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354403, "uuid": "c7a1f377-6e2e-4a9b-bb17-831df8de095e", "value": "741f0bf68a28ce3a873985d135617016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354403, "uuid": "df17cf95-a991-4abd-b0b7-a11e713100da", "value": "6144:r+txhFHnCbTsO6tTFjonCwxuFkQGvnT9yBbdJXtN+onVdz4QLr8WrnRmmW7IrjiI:r+tzFPfta+gT9udJX1S0mGij4/4DO8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354403, "uuid": "7364a9f7-e45e-4a6d-a2c4-b6fd2615a86a", "value": 620696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354403, "uuid": "dd72d92e-dfd1-43d4-8e60-cf9206f7c8cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354403, "uuid": "2c12b0e6-592d-4250-8eb7-080401f73d12", "value": "8d0c4a2565d38c923a50bb5daf512a7b80633643c65b5464d665e5f71b8fbd55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f068f14-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333044, "uuid": "812dab21-e16a-4ae2-a611-264ecf5fdb11", "comment": "Malware payload (Mirai)", "value": "1e6d40d2f68eaf6132e464e79ae0c47e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333044, "uuid": "1e1356d1-20ac-4d7c-bd7d-f8d711d6a478", "comment": "Malware payload (Mirai)", "value": "8d2b9ef75ecdcca8d51a9fdcf442526910d0d50cb692d40084831900d6266e1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333044, "uuid": "590e726d-01de-4d3a-8641-1c82159eceda", "comment": "Malware payload (Mirai)", "value": "1e4e9db7cd36e6ad5e60d8744fe3d96df93c0da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333044, "uuid": "2e268f4e-4c0c-4764-9f86-9b0b47390aec", "comment": "Malware payload (Mirai)", "value": "fd1b880cbbe40f7caa3358e5034fae45c20dbd3b148c1aecc6fe40f3ab62ae44545ed9d41c26d26b21afc467fb3877be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333044, "uuid": "c1a6392b-aec8-4c01-be91-748d0a774986", "value": "T1EE834D89F783E0F0DD4705B1116BFB7E9730DE125124CE5ADB94BE76AC32A02A11A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333044, "uuid": "260e3a9a-d188-4107-ac55-f65d687850eb", "value": "1536:oQvjuVGVtxHrc4PyMl/0d4jonofy7CNvU7314NNPt1C0ftr:oQjVzrc4KMl/0CzaHivCOx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333044, "uuid": "4fd91d07-3fd8-448a-9f58-343919b4e79f", "value": 86784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333044, "uuid": "e02019ba-75c8-4485-8520-11da0ff1e4e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333044, "uuid": "e919e709-e4f7-4e63-863b-a30769e28892", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ec810c-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333165, "uuid": "c314756d-0cbc-49c5-bd11-dc8edae72a0d", "comment": "Malware payload (Mirai)", "value": "582c93c648c39af337e11b703fd37128", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333165, "uuid": "d2061b05-d032-489a-8518-4fc35342dc20", "comment": "Malware payload (Mirai)", "value": "8d3c34527d9463895ead1c96e6fe2718adc3e84a4a18d121f8fe298d0950ebca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333165, "uuid": "7a4e21d3-29db-4ec2-a9d9-add731dcd32e", "comment": "Malware payload (Mirai)", "value": "454ab44a7126fcece728052c5fed1b5461708b63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333165, "uuid": "7c833dd0-24d4-4399-bec7-ff1c150b0fdb", "comment": "Malware payload (Mirai)", "value": "9d208b55510604708d0d38d9652a6fb66830f092c7cd9bc033662bb4356bd91c12b894a733d3855f6f9b9db5f6c3a863", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333165, "uuid": "e24cb8df-915f-432c-80aa-a85f078e1957", "value": "T145C30659FD416F01D5D636FEFA4E028933531BACE3FE7202AA245B2127CAA5B0F76105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333165, "uuid": "5eeca83e-f770-44a1-8e72-7e1439c81c48", "value": "3072:P+MfDhco/yFQASMPspgjaUfikzRXn6uTcq4qQqwe+550t:PJdf5TMUWjaU6klXn6PMQ3e+550t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333165, "uuid": "74bdb07a-34c4-4aac-aaf4-2ac104648f5b", "value": 128740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333165, "uuid": "713cfd3d-b374-495d-a940-704b61450633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333165, "uuid": "50f11f6c-9d3c-43d6-bd10-78fe8c7eee71", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f0270d-8b16-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785306588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306588, "uuid": "b255c817-22d5-4b61-909b-65f9d7eff403", "comment": "Malware payload (Mirai)", "value": "b5f0a7d5df3b7ef3e44347e052ddac24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306588, "uuid": "6f0c133e-7af2-4512-af69-d71ff7a889e7", "comment": "Malware payload (Mirai)", "value": "8e86294bb3504f34708f1c4ea4ebaea738b0220ec1cc4c2fa13a1f061d9b2ccd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306588, "uuid": "4f2aca5c-3cb8-4dd4-af2e-6819b5911487", "comment": "Malware payload (Mirai)", "value": "b902a37a292ab22fbcacae9dd22e7b00fc435e73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306588, "uuid": "9e956a8e-1e8f-40e6-88dd-e1f3e4ac9b31", "comment": "Malware payload (Mirai)", "value": "87a3be0fdf0e275663a8045472fe3c0476cd66d954612f54e9100be27d882a107845f885bfbf80f200bd21ca150440f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306588, "uuid": "83277517-0c67-4691-8189-bcef1ea919ee", "value": "T107F48D2BB2B2F1BCD01BC03047DBCAB25532F47526312D7B26C4DA353E5ADA1136AB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306588, "uuid": "8b855eb1-b3f9-438d-a558-736ce2135cee", "value": "12288:PJweKM8Pc24RUNgD0TltId1Hq6VHDutaI+1anayUL2HX:RweKS2EUNgDWlWutf+1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306588, "uuid": "67f57392-5e85-42d7-bb76-ad5123b28e12", "value": 747512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306588, "uuid": "0256d61c-f16d-4877-98ef-a39bd5ec0bfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306588, "uuid": "b73dcd7d-1a78-4a70-a53d-33ca1b5cd78e", "value": "real_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d698afb2-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313864, "uuid": "8d3802cf-8058-407e-9cb3-b007a3ce964b", "comment": "Malware payload (Mirai)", "value": "19efeb57f2df16754ee5a587d7643aad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313864, "uuid": "fea2f574-2b49-4954-b2fa-d1670f572210", "comment": "Malware payload (Mirai)", "value": "8f51da6e72b00cb4c261c86ed00fd384c59cb6bce92f3f2ab9afa8a6902f9c78", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313864, "uuid": "754ad25c-0705-49b7-9693-42179d29d8b0", "comment": "Malware payload (Mirai)", "value": "1226834444c8b186437821f7ddd6ef57a85a0528", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313864, "uuid": "1a5961e7-c659-442c-b504-363bbbbdab79", "comment": "Malware payload (Mirai)", "value": "aa4534b0f6245e621443136f22fb4083dcf69fa06fb11de8538603844906910f5ffbc94de61f86cb7bf334cd03c9a652", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313864, "uuid": "5e1e0f5d-ef10-480e-a171-27975fc54815", "value": "T1EB532BC5B8829513C1D402BAFE6E128C376A13F8D1EA7207DE259B61379F82F0E7B551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313864, "uuid": "c66199c7-94a1-426e-8548-82a8becac634", "value": "768:JB+902M6THFKKbDfuB9y0BGSPeTiB/NxS+5YOtjDgyHViSUAMDDuwfJS4V9YvAO0:v+9fuCEGTiB55YOtN0HDtS4HYv/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313864, "uuid": "2e6f2211-b245-44a5-be40-9e3b92b6ab32", "value": 64616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313864, "uuid": "428684fa-7756-45a9-a104-ecf364efee65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313864, "uuid": "d39b041d-4ea7-41a6-af6e-7f497a075798", "value": "real_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef940fd-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327354, "uuid": "d80b0df1-0122-47f3-bacc-3494d7475e90", "comment": "Malware payload", "value": "78a6b14a7a18df5a21efacabb13b424f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327354, "uuid": "8b7df651-6246-4a11-bc69-ae8398d7916a", "comment": "Malware payload", "value": "90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327354, "uuid": "e73b9491-43b6-4c92-b689-74cef94871dd", "comment": "Malware payload", "value": "1cfc8f6bd829211dda7886ae1bb852f3a8648bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327354, "uuid": "2f6be9f4-dc0f-418f-b0f0-b2de191170b8", "comment": "Malware payload", "value": "5dcc1f3c9cf85b18a502c559639cc2fe7d023369783790be520aeda39b0e83b5130bf6271975880ae9d4a82650b5b127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327354, "uuid": "a6bf93f7-94f8-4cdd-98dd-017ed6a7f75c", "value": "T1B9D47C6274D51895C133C2F2CF93E1689753FC791D64852BA2CD2E162F0AEA12D23EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327354, "uuid": "1b199e50-bd49-42fb-99e8-b2c9e21aad50", "value": "39e02ffded34b5af420a331c1a5785d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327354, "uuid": "a9a98652-4698-4c9b-b81e-7eab0bf3fc12", "value": "6144:0rNWEayAsnwbtsn60101KoavRn3xaBVTFPvt2ONzTpv5TjVTxbQnAEnOrJ/ejcxB:8NW2n7ecRxYTFP5xL2Keja/XJv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327354, "uuid": "f4810d4d-c8df-4689-9dbb-4ed673eaab58", "value": 645784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327354, "uuid": "444cd95b-03c1-4be2-ad1c-c79a6dcb8d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327354, "uuid": "9fd9130d-216c-4dfb-b0cb-85bfb241d68b", "value": "90f2ac28649c8877379014012263125fdb86489ccc8d6cc80180437dbdf3be8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20100bcd-8b5d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785336751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336751, "uuid": "523af1c2-3622-4b58-a6e4-bd0d21f4b518", "comment": "Malware payload (Efimer)", "value": "bb13d29331412404a07db7e9375aa9cb", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336751, "uuid": "d24baf46-23f6-4a9d-b965-aa7872917d4a", "comment": "Malware payload (Efimer)", "value": "91426a0ecbec54c757f946939bcfa983a365c12c4b4350d0565ecb46039ee353", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336751, "uuid": "5fe675c9-ce30-4042-89a3-70d6341a613f", "comment": "Malware payload (Efimer)", "value": "38b34b90da9e7770bedd699adb9cfa0feb386110", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336751, "uuid": "0abe9bdf-6a23-4785-b83b-656def4eb54a", "comment": "Malware payload (Efimer)", "value": "8f789dd450c2ab8f57d49c1f936a23dba4463ac2ebafd059e92eaaf47987e5af821b622ab215ec823f7bfd8f864a4b3c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336751, "uuid": "04b8f48f-dc6c-4aed-a09a-e97be3827212", "value": "T1DEE633882AE503DEDA73D17CDDE18AD2CA5934775B32CD8F1BB446A22D131E08E39653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336751, "uuid": "bd6ccb88-6af7-4f14-b018-ae4417f66d74", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336751, "uuid": "a16dfd76-2443-4da5-adb8-3c519c5c1a91", "value": "393216:063Cx/jSLyaRAEBNEdgpnbj2d9IXMCHWUjXAcuI3/PGTAI:063SOyEDpX2gXMb8XVH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336751, "uuid": "597ca6d8-f679-4828-8e8d-c00bbbd9d0f3", "value": 14325525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336751, "uuid": "bf77d100-3ea8-4815-9a5b-bd18122d0e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336751, "uuid": "c7822b77-a173-49fa-97cb-7578ed65abd2", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0689278-8b3e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785323652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323652, "uuid": "a057d786-b1b4-4bed-9b6e-dd74aa4ce54d", "comment": "Malware payload", "value": "7bbb122f7e1fa16a2b95ca2b3ba62441", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323652, "uuid": "5d8890a6-2090-4417-b4cd-8a96c57591d6", "comment": "Malware payload", "value": "914c6ac38868363a37e12bd2b6088a3de87ea62a1765948c4faf31ca8bfde88d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323652, "uuid": "7d354e78-a279-4886-8250-001c1a42cd3a", "comment": "Malware payload", "value": "3eaa3f12ce50d64f86bdf8dd2de30381fd99afa0", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323652, "uuid": "95eb2683-b3e1-44a3-9787-7226e6777251", "comment": "Malware payload", "value": "5dad53e3993f35def2e607cf8b1f35a410bc6ba54ac85219b8717f919620c292c63b79891220ab77b24565d11b0cd31f", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323652, "uuid": "89b0bac1-9998-4170-a59a-4a7a7dbd4229", "value": "T1A872C81762A82C96018732B7E4CED208B269156F10982F9474FCC39AFFB257D03F579A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323652, "uuid": "dda924bc-53a0-4d5e-aef7-1a91d4ad9c8e", "value": "192:4/ay3U+rLaj6bW3LLPK3jo2DlUtk64+zQkmP7F2dyH7FS7FII4Vq73zMFoYogWcF:4/2OUqr26oLgY8NQB2IOR1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323652, "uuid": "fb72fe05-d0f8-4868-9ef4-83d0045e89e4", "value": 16732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323652, "uuid": "5cf5632a-46c0-49e0-aa0b-6ff9bb6d8ce5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323652, "uuid": "4c7252f6-f64d-4dbb-8849-b720b4834a39", "value": "__e_r.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c064d1-8b35-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785319552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319552, "uuid": "6a4ce8b4-733a-49d2-a088-fd93aa5ce55e", "comment": "Malware payload (ConnectWise)", "value": "6b44ea9b9e37d54ffd8d7737c1fcf0ef", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319552, "uuid": "8728dad8-d793-4989-8080-a05b3b410edb", "comment": "Malware payload (ConnectWise)", "value": "92a466dfe16c32bfda121f36c95774dd26d84bd34258199f6e4cf9995e515268", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319552, "uuid": "6e7233cf-807d-4ff2-bf54-72fd3f210abd", "comment": "Malware payload (ConnectWise)", "value": "e57dc3acefb4b8a9738c119327193d6088a7db99", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319552, "uuid": "90854980-2905-479c-8680-724123dc00d1", "comment": "Malware payload (ConnectWise)", "value": "7d8ac64cd09218e810c3130225c13a6ae402b9d0fc5b074c8d93b1f4ce0697f678d0b6ac9bfbcfae3dd4bdca880ef22b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319552, "uuid": "d3b4edd1-01d2-4679-ad07-be54fc41d507", "value": "T1F4A6232063E58466F1B70A3EEE3586F4597A7E25DE12C08F63A4791C6D32E50CA72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319552, "uuid": "e9d08499-d0d0-48bf-a29d-82eb6b8a42f2", "value": "196608:jgHxiFSsYwwSA/OdB+74xzee4gHxiFSsYwwSA/OdB+EgHxiFSsYwwSA/OdB+pgHJ:j2xiFxbwpaNCl2xiFxbwpaD2xiFxbwpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785319552, "uuid": "9d48f750-cc7f-4c1e-87ee-f1afd4522052", "value": 10227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785319552, "uuid": "5e32d3fb-355f-4eaa-acfb-d146006baa4b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319552, "uuid": "63d2d332-46ee-4063-afdc-53b93fb5b664", "value": "ScreenConnect.ClientSetup (2).msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26f8bf0-8ae6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785285993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285993, "uuid": "9826d2c5-6f82-4c83-a650-ef518691987b", "comment": "Malware payload (Formbook)", "value": "61442f20e71092e3a7a91893ce9c9b34", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285993, "uuid": "756de2ca-f2cc-42ee-92ec-bd643d62ac5d", "comment": "Malware payload (Formbook)", "value": "92d27e98374b36575b4c12c8ab050c55befef8a27401a97dd2493d40469981fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285993, "uuid": "c2e7d9d7-b6b0-4f22-9f68-6bb191529d23", "comment": "Malware payload (Formbook)", "value": "3fbc56b3deb26fcfef0276b2cbdebcc5f472ece7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285993, "uuid": "08e8d3dc-4e12-48b3-a2d4-19b4f8f22297", "comment": "Malware payload (Formbook)", "value": "84e55153ff74f335945287b114f515d9dc67f8cb2c9a0138bd10a7e433c8f1e008fde064c71f2be478868bcc6c8d570d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285993, "uuid": "2ec434fb-cf56-4c8f-a33e-27a5450c7bc8", "value": "T1E4F51AB132DE6B06AE0D7719984C4F18431AC0299F63F48570DF97C5474F98A6AA8CBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285993, "uuid": "49bac02c-55b2-40cc-adbc-f9a785871621", "value": "12288:hYdB/HsX1uHnSvylUWM8fX6jiKz+c6nkv/WtuelYK7AWQNlvkANSBYbmeMXotu3c:hQfyZR2elT9RMqUAl5S146o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785285993, "uuid": "1116d746-7e20-4ca9-bcf7-0ecd72b09753", "value": 3343748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785285993, "uuid": "d1fce5d4-b2c4-43bf-a1ca-966e827f8643", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285993, "uuid": "a187dd19-dada-4dec-8584-6deb13fcd4a9", "value": "MV_CHRYSANTHI_S_VSL_DESCRIPTIONpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86d59a9-8b1a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785308203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308203, "uuid": "b28d039c-a67b-4b24-913b-e89f35daa50b", "comment": "Malware payload (Mirai)", "value": "6b52f4ae2140b084cec41d4dfc94e19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308203, "uuid": "85c83020-64c5-4ca6-9da6-bcd60ef3c6bc", "comment": "Malware payload (Mirai)", "value": "933f5b863d31390bd0ece05b5161a9e4c7dd440f2bc5c519f3ccb3f59a9f2437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308203, "uuid": "a6a3e028-0d89-493d-abca-8559aff5d48e", "comment": "Malware payload (Mirai)", "value": "80cbed146915f2cfa98a7419a20d35b3235a4ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308203, "uuid": "e8fcac7a-ccfb-4470-b2ff-b1fb578ff613", "comment": "Malware payload (Mirai)", "value": "d1350ea86fb73b9818315e0adf71250938aa3ebeaca1fa29e45333afffa5d1c5e62f5f5ba887c7830a093ef9e021dccd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308203, "uuid": "7ec13531-3f1d-4ab4-801b-8830bb12a3de", "value": "T173431A85B8829A13C5D412BAFF1E428D372713A8D1EE7307DE256F20378792B0E7B552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308203, "uuid": "701da5df-188c-409e-bbd8-ca3e98131d35", "value": "1536:fekKABsDK5LTRuXD3GtOxYZvC1g+06vK:2kKEg3iZvjGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308203, "uuid": "3b2343ea-c912-49c6-bf80-ed3bf611bd93", "value": 56748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308203, "uuid": "9169043c-3c58-452a-8317-521972a8a7a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308203, "uuid": "47d61a44-2438-41b4-92dc-43254789aa5e", "value": "real_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9770ef24-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352842, "uuid": "40013a4a-001e-41d0-8941-883671db2a67", "comment": "Malware payload (Mirai)", "value": "c8cd4a24157de566ca3116fbc625e369", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352842, "uuid": "d4b83dd8-7b6c-4732-b879-db2ae2f08d4e", "comment": "Malware payload (Mirai)", "value": "9378b08d1f873cc78b3eae058a3f5533590d932a53a0f8ca1a9d7a3533398773", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352842, "uuid": "f5b2d8f9-5a17-436b-8cb1-5122aae1e1fb", "comment": "Malware payload (Mirai)", "value": "df90031c5626504451c10a5f6c26cf927e0e7435", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352842, "uuid": "35774b31-bc9a-4f34-8940-624c57f16383", "comment": "Malware payload (Mirai)", "value": "d637005671115b8c24af8575ee7446bbbecab0ebe3ab0f63e7c25b3f0e5f49020c8e587d9fae35985f5dc2ca31d5b7cb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352842, "uuid": "2cc21b43-23b5-40c1-9d71-808d56b52c41", "value": "T149016BCAE2609D108019D81E22EA9690B430C7C7554B0FA8FFDC943EEB98D14F066F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352842, "uuid": "3159ccff-0972-44c9-933b-46e2744db677", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaxECwMjCS5rrF5FCrqzxdCmyCJN8TauD:kXCKysE2hi0ziQvZohaxEYr3JdHOF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352842, "uuid": "204397d1-448e-4eed-92af-c044a474efc4", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352842, "uuid": "d6b0d0b7-d315-4a00-bda9-4e69424acb9d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352842, "uuid": "13467384-603d-4988-8c5b-80b940272213", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4cbc34-8b09-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785300752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300752, "uuid": "864be132-28d7-4eec-8554-e85079d487e1", "comment": "Malware payload (Efimer)", "value": "38b7362e99e01bc4038a0b5d8498da32", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300752, "uuid": "eda14381-f59f-4e93-adff-d51dc74a53b1", "comment": "Malware payload (Efimer)", "value": "9454ca8bf4989d4088b8c80f430d852d13e85c09252275113d7132c0041dd1a9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300752, "uuid": "71767e54-4ba5-4e33-a27e-3b7a9414daf0", "comment": "Malware payload (Efimer)", "value": "af89eebda437878da89efa56768b1fb05cb2eab8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300752, "uuid": "188a65bb-d16b-42aa-91be-a7c7478f253e", "comment": "Malware payload (Efimer)", "value": "652eabbd102aa15274b98e79af3fdbd9484c491ac76367865fa424d71a1950688d4e5c987164d31b8fe91b72c411c6ad", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300752, "uuid": "b75094a0-006f-4c8e-ad06-98b574bb58df", "value": "T1C7E6330499D511DDEE73D03CAAE616A9E0E8B8F54BB2CA9B13E893906C533D09C39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300752, "uuid": "51cc5a98-4636-45d8-a23c-5e8d5a0de8cf", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300752, "uuid": "4752d2fa-bfb3-41c1-9d74-5df870b620f7", "value": "393216:HPVuzheOGt9udlpW/XMCHWUjXNcuI3/PGTAI:Hdch7G7udlo/XMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785300752, "uuid": "40aaf98c-be93-44bf-92db-4bf4e4b8f5fd", "value": 14287530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785300752, "uuid": "91122754-ff64-4786-a861-380ef190d5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300752, "uuid": "a17be597-3210-48ea-89a3-5f1b0722e870", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37664474-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327341, "uuid": "e824a43e-9319-4cb0-84f5-05481198e938", "comment": "Malware payload", "value": "13339c900ef07a4a4bbb1e289359e6d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327341, "uuid": "c321a634-f601-4143-818d-d5cccad8d389", "comment": "Malware payload", "value": "946243289414d475c5fba55850ae2e7e9bb56717ea1bd8ee765da36455df9b2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327341, "uuid": "5983a920-f8ce-4730-bb77-59a43f1b04a1", "comment": "Malware payload", "value": "c3427371b14e2865f41216b0e0fd3d67a0b82e2b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327341, "uuid": "8a2c145f-d61e-4217-a842-93608741ff57", "comment": "Malware payload", "value": "5a2b5f7109bbf14571daecf8e95dbbef89d62d9d70d882f07f1bed45d12a86ee414c3e44fc69a3d8f3ab6ab0b32b4656", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327341, "uuid": "3d3bd934-110a-4401-ab9c-d6fd1044e3c3", "value": "T1DF55AA7CDC18927EC273C62DCECB8A03F892195A361DE94EA1D2B3579523153F8E216D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327341, "uuid": "a5ca5e10-3079-460d-86c0-a3da5ccc9428", "value": "3072:JRxSQ7zN1mXTgZAHCOph9/M98O01faHBrxzgTQMs0G1pNqQkofbVewJGK5ImZ7Uf:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327341, "uuid": "d548e84e-cd09-4a15-983c-37298623b82c", "value": 1288520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327341, "uuid": "63845ba6-65a8-46ad-93d5-5e05ba688beb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327341, "uuid": "6d145429-8706-4913-afd8-16e6cb156138", "value": "DOC07282026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2420cabb-8b45-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785326450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326450, "uuid": "acdb6ce7-7677-4144-b254-218f4871f6ea", "comment": "Malware payload", "value": "820f5f51c57a9cb1373c9a8367a507e4", "object_relation": "md5", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326450, "uuid": "954e3b59-00a8-49ee-9112-c24e9cee6e15", "comment": "Malware payload", "value": "955e528e5783ef01dd38beaf307301791235123867743a7a62424b3fd4646278", "object_relation": "sha256", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326450, "uuid": "40ea4121-26df-45d7-84da-93d09b115c30", "comment": "Malware payload", "value": "96283753ee2e5e80dac6e1c51d2792a43c4f5689", "object_relation": "sha1", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326450, "uuid": "5182fd23-a249-484f-b30f-e1a0c40642b8", "comment": "Malware payload", "value": "55ae0e6586a9f3b697b9f4f10a01112252bc5fb9e4c690e3f5ae678341337bd5f6394f5a3e94e89ce1e41e45ee8bdd66", "object_relation": "sha3-384", "Tag": [ { "name": "cowrie", "colour": "#9221FB", "exportable": true, "hide_tag": false }, { "name": "hermes-noc", "colour": "#76F1BC", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326450, "uuid": "60a54873-f71a-4938-ad6c-4222e49154ad", "value": "T1373101DF54506A3A1302CDCE73BB3658B50C81FF289BD750D9894EA982989CCB262FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326450, "uuid": "85a0f0b1-06e6-48fc-8305-ef554306c341", "value": "24:d2O7yg1fA4+e12BjXV6o5dDA6y4Wd3WUWduU:d24yg1IeIBQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785326450, "uuid": "34b265c3-53f7-41ec-85ee-b5a62e6b1ef1", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785326450, "uuid": "9ce2abf7-42a7-402b-a6e8-3549e6b972de", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326450, "uuid": "b074edde-86de-428f-8c2c-586728ac704b", "value": "955e528e5783ef01dd38beaf307301791235123867743a7a62424b3fd4646278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2b5034-8b06-11f1-bd95-42010a9c0009", "comment": "Malware payload (VShell)", "timestamp": 1785299671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785299671, "uuid": "9af6314b-8ad9-4e38-bdf9-7cd5736b054d", "comment": "Malware payload (VShell)", "value": "99bf2cadfdf4639410f67018b8e9c6bb", "object_relation": "md5", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785299671, "uuid": "effe93a8-05c4-4ad2-95ab-98f1c111d641", "comment": "Malware payload (VShell)", "value": "95ac4f25ca24aab7a5a443b813a3f92f0bbbc0a431e5e75764609f9214c114b3", "object_relation": "sha256", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785299671, "uuid": "81f61dbe-8e47-48e9-8bcc-3bcd95860af0", "comment": "Malware payload (VShell)", "value": "4882c6a2482976131bf1a1e14be1e7b0f141ac02", "object_relation": "sha1", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785299671, "uuid": "cbfa59f6-6ede-4fde-93dc-1fb0e6b3a612", "comment": "Malware payload (VShell)", "value": "b538f10aeb6420489ba62b9a7b488126eb46949d318765087746fb52ab315b82f62393752f5bf53df38bae5e05acbdc2", "object_relation": "sha3-384", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vshell", "colour": "#9EC2F3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785299671, "uuid": "71aa2ee5-4f33-41fd-9d1d-71c4b0b10633", "value": "T1F3538D07ABE1C5B9C6E983B9749285A09371FE634820D62C3A98126C3F677449F1DBC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785299671, "uuid": "6b06a8d6-968a-4351-ae7a-c2473e92aa47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785299671, "uuid": "94324d4c-f063-4a23-b95a-cd45288e1203", "value": "1536:qEtD6z9cghpuMQixXQKdGuUEmnLjD3RE2EhLJ:qEtOJc2QiXILj9E2EhLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785299671, "uuid": "30fc74ed-a962-45af-bf99-531d42346deb", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785299671, "uuid": "872596cf-f153-4dbf-88ae-b3723e460d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785299671, "uuid": "28085093-72e3-41df-95c7-d6f758ba9700", "value": "UpdaterSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39fd7d10-8b10-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785303723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303723, "uuid": "e4ce415d-eecb-4bd0-83e0-684de5f81d75", "comment": "Malware payload (AgentTesla)", "value": "f9a332b13456c80d026d7651dc63df25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303723, "uuid": "7124a533-14d7-4496-b58b-4958872c6d9d", "comment": "Malware payload (AgentTesla)", "value": "95d43193f2c25ae63f5e110243bd4eaa62b930e5a959393eb731a74953a9432b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303723, "uuid": "5052c6d2-25ac-4da0-ab89-dc6f8e8dc027", "comment": "Malware payload (AgentTesla)", "value": "cb13ec0905360dbbc92f73a8c45b9cb137a5ac2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303723, "uuid": "66d0ea1d-4fa4-4959-99ec-745ef6a341b9", "comment": "Malware payload (AgentTesla)", "value": "aa4f925cce8f9c9fb84d547166cc59e0542df9e6990f1c71be968fd9741e1cd112ce5f310cb2a0184f0d20849d15b36c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303723, "uuid": "1c6e37f1-0ab9-4f90-a8bf-c0ebcf90ff7d", "value": "T13B930C1649D778D0633776BFA22AA8E4F7760B6702401917B83C6450EFF2A0ACDD1DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303723, "uuid": "8e3ff424-0d0c-4483-908a-c5dd9d8f7bd8", "value": "768:RCLhdJzIo5gbH8PW0E4xW0vEMi+XfHnKoGL5ep36CTiDg1EpqX+Qw2/ZVdzz+dVk:AZ1vE47FrN738wdS9grV/qmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303723, "uuid": "a4cb9ed4-0312-4033-a8f4-0ba5781768c2", "value": 90115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303723, "uuid": "b4ad576c-2ee3-4f93-aa75-989da6239eb4", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303723, "uuid": "d8fffe2e-0dd4-40d5-aac3-4f896aadd543", "value": "Directrices de pol\u00edticas para empleados_2026.xml.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b136d07-8b5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785335427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335427, "uuid": "12cfab1a-a32a-4747-812c-91d062588bae", "comment": "Malware payload (Phorpiex)", "value": "1ab31f82e6c8455c61f3a14b753a7ace", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335427, "uuid": "1aa2471b-6579-42d8-a618-c516ff1bc8ca", "comment": "Malware payload (Phorpiex)", "value": "96508589d281460eab4eb1819c80e89bdffdb5fe86b8fe1400bb9268deb09e74", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335427, "uuid": "3c2dea7a-8dcb-4bf6-8347-2409d7868c31", "comment": "Malware payload (Phorpiex)", "value": "a640e807b4ee821cd1ba76649139721447b3e3b1", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335427, "uuid": "55118a7d-d8f6-46e6-ba0d-eaf3b5fd678b", "comment": "Malware payload (Phorpiex)", "value": "6415800ab104041efe5bb6e90dd7bf442f8fb9a78aae827dd3f8e760c945bcf57fdb5f4ed2fce70633a564dc66b30f8f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335427, "uuid": "ec5abe40-7295-4ec3-9b8b-33383a37671b", "value": "T10C623B0AA4818035EAE04075827F526649FE6DB623C4F9D7F7E0A8C94DB4BD1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335427, "uuid": "327a2481-a4f3-418b-8cb4-c2d5c7eb156f", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335427, "uuid": "b421b1da-f805-4d91-a140-84e8dc5915fd", "value": "192:AW7sGnjXgjk8LcRI+Q1RDMRYfV/F5oIVUBKUSftzQFBrfgJxTmv8U9cthf9ik:AWScCRfV/ro6toB0av8U9clX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335427, "uuid": "9289bacf-d8c8-4649-9267-ab6932bbcb60", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335427, "uuid": "b5d6f54a-b85c-49dc-9053-7cf709a053d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335427, "uuid": "e082f346-21d7-4d45-8f23-0e97c7a150a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a84c52-8aef-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785289725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289725, "uuid": "de991ba3-a467-4adb-938c-77eb9c765501", "comment": "Malware payload (Phorpiex)", "value": "682b9aca0ad2123c253d8324633cf648", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289725, "uuid": "4764b34d-32b8-41cb-8b30-f7f9c624a532", "comment": "Malware payload (Phorpiex)", "value": "96aa9b5fcc9f02bf0879ae9b1e088b3f8dc978ec323da003b194fb660acd0713", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289725, "uuid": "d1cf794e-4dbe-4968-ab2a-44d7d19bc89a", "comment": "Malware payload (Phorpiex)", "value": "f05a7689454b9a1ae949f8177eaf6c1d682b8d57", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289725, "uuid": "cb979317-ac86-4019-afe5-31560f512a5b", "comment": "Malware payload (Phorpiex)", "value": "66b6c447da3d20b32f136cd7c66160932da372323c9a950f88d497ecc58364b51ec568a8def7d5a2a48e707519da0842", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289725, "uuid": "f9cfe445-0ac9-432f-a79b-8ec2c10072cc", "value": "T13B823B0FB9424316E1E110B4966596BFD9B9AC7633C414EBF7D44AEE0A686C1FC3610F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289725, "uuid": "225c8bca-a6b5-4fbf-8427-94ca4fed53fb", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289725, "uuid": "695373c1-39fd-445b-bc71-f6610125f309", "value": "384:AZZbmcmhzcEUaUu94gXTP+av8U9c+z4P:l9UaF9Ka0U1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785289725, "uuid": "0684e1d6-7e66-4151-aec6-436d3c0a3a41", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785289725, "uuid": "c72e0260-4622-4d8a-af53-1c14a5d41706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289725, "uuid": "76132201-7757-4195-a943-6e03d55dda83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b073eb8-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324475, "uuid": "db1dfa26-378d-4d4d-9263-a20af8277498", "comment": "Malware payload", "value": "ac437aef4ec19cdce5fa13dcc7b029b6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324475, "uuid": "5997414c-44e4-4da6-8496-1f0541824de3", "comment": "Malware payload", "value": "9708f2b3225eccec088a0a5cdcd6adcb195a7df82ea3742744d97fc19ba79cae", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324475, "uuid": "b7059036-5cb1-435f-9a16-35317d53f113", "comment": "Malware payload", "value": "8325c2b53e4300d5f57615f90cb3ed3f9020eea9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324475, "uuid": "e31bdfa6-0bb5-4ba9-b7f7-ca83939e9e8e", "comment": "Malware payload", "value": "fa04787c1e526c530f4889c9a860a1db1a4863223aa5d291d035b3609ed4ab00703a4c1441aaebb35c1e59b6c92cbaa0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324475, "uuid": "d334b79a-960b-4eca-befd-c84569dd9cc0", "value": "T1DF311944A321E490DE91BB38FCCE902A7017305070587AABF21CD5D38DDAF261561095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324475, "uuid": "549a8acb-ae3e-4095-9d68-1680d25a2577", "value": "24:9kJ4weFg6wbp8fE856CVWxEjr4WUjdA6h8mOk/B/Omk0XV/5cpeYy6hSKVqN9H7k:9k2weFg6wbpgE8s4jr4WGAK3OkATgncz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324475, "uuid": "1abe097a-37fa-4146-81c2-465ecad808de", "value": 1490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324475, "uuid": "cb3293f4-b5d7-4d4a-88a7-f3d3ecd327f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324475, "uuid": "6a9accc3-5147-4be1-bd74-0918d612f705", "value": "photov_377599207009.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82893fe8-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785354525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354525, "uuid": "2d0df6df-7030-4cfd-b508-2c91a1a0b37f", "comment": "Malware payload (Mirai)", "value": "aa3dd10879cd98e1e3327b96c6f6a6f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354525, "uuid": "6e104dd4-a9cc-41da-b30c-88353d34a949", "comment": "Malware payload (Mirai)", "value": "97c77f02acfa0a62992da06101c5e07e713b68f58e59098a209030a06ff2aa2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354525, "uuid": "80f3d672-3316-44a7-9bc9-a286a42fc0e1", "comment": "Malware payload (Mirai)", "value": "12bd22be8975c4d169a74e5c0cec7f4883b01191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354525, "uuid": "dd97bd2a-a2c7-4c79-9a49-3ab34eb60446", "comment": "Malware payload (Mirai)", "value": "2ae949ee9572671c02b28389830a3264baa8777dee8a9ccbf6a6dbb3316fbef13f5528dd8d39c432bd85615951e60353", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354525, "uuid": "592f76e5-60ba-4242-9b54-d773e4b52c9c", "value": "T17DC34DC0F243E6F5D84605715037E732DB76D6E6211DEE43E398DA3AAC62842C91AE9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354525, "uuid": "82167ead-a3f2-45fd-85e8-0ad3bc4e3e67", "value": "1536:EX+Dp51T9e5sSyvaiR6xSEL0KjpURSCmPoQLSqcBLkb9EJD7p:Xl51T9e5oaiAIlspQSXPRGTp1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354525, "uuid": "58b89314-1a77-45e3-9136-75395952c3b0", "value": 122412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354525, "uuid": "2d1aef2d-d522-4967-af2d-40a5032987ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354525, "uuid": "64d1018c-ca9f-4372-8a0f-2400c6c76827", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e902b18-8b3b-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1785322360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322360, "uuid": "62d22edb-377e-4aa8-9d01-ff285cf249df", "comment": "Malware payload (LummaStealer)", "value": "803b5aee2d97654630910acc48c49964", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322360, "uuid": "d40faad9-e3e7-4c9a-a643-acbfeac12cae", "comment": "Malware payload (LummaStealer)", "value": "98d3876e0850a8a70afc220e945c24723b5ea973f187eacf23958acfa9df2e68", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322360, "uuid": "a9909ef9-8ef2-47c9-a4f5-fb2f4ef801af", "comment": "Malware payload (LummaStealer)", "value": "ab5033af0f9010f316fa0740a34ee528731f788a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322360, "uuid": "9fed4b67-1dfa-4450-8c2e-c2ca9ad5ab5a", "comment": "Malware payload (LummaStealer)", "value": "5f9dbda83a663d257c902c9abfe1a48ebf3770131b646e634b1d4d722ca92b4f26a516c606ddfa4b2e6a7ccaaafea3a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322360, "uuid": "fa10f284-9245-450b-801d-9f4f53dc577d", "value": "T18DC55A10EDCB85F6E003163169A762AF63356C062F32DBC7EA547A7DEA772D10836709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322360, "uuid": "c57e1737-d658-4a02-a0a9-bc46f9d5e795", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322360, "uuid": "61f27b4b-30da-4f38-914b-520e296e5d33", "value": "24576:IriIQXuVHx4Mg/LzP/cELHUvoWgDVKMkOKS+yT/kvB1CxU6oJmFDJ1sWBqx80+bF:ImIChrLyiqJmdJ6dxv+M2hdU5sbshJ5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785322360, "uuid": "f3dcdbfe-6eee-4fde-a94f-b69778aebcb3", "value": 2640216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785322360, "uuid": "91080707-883e-48f6-87e7-7782553f25ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322360, "uuid": "a6c449c7-2d53-4287-8696-e9a0316b63e1", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f76d9b-8b51-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785331583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331583, "uuid": "c775df1d-1af4-4be8-b592-b99e14ab6f77", "comment": "Malware payload", "value": "436c70c2d01b3af47b056f83ce453502", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331583, "uuid": "ce49bd99-bce7-472f-9c08-d23f661366a4", "comment": "Malware payload", "value": "993a91711f05462dd1b5ebed9bc75892812d1029d0f40db02ff2145e11fe7d12", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331583, "uuid": "a1695edd-42de-43b3-8bc8-11d6f65fcd65", "comment": "Malware payload", "value": "419ea4968bdb5fdcd3957f7024df5203a32365c6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785331583, "uuid": "905db2a3-1390-462b-9248-0db8411c36d7", "comment": "Malware payload", "value": "dc31d17db32b4c226525416431d7a7f24e6cb98d51ab2c79ba08f912619f744eb60dd74af7112a30de113eb4e60c4647", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331583, "uuid": "d06f4410-8de2-4b75-8e2a-2d2833aadb27", "value": "T1028112AFFE6886305056544651DB9C3EE19607B3BF54C88FC10C6DE42AA4BBBC1A9C86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331583, "uuid": "0ec21fab-d2c8-4c1e-b5ce-e1d67cdb330b", "value": "96:BYDXYN53GfYBcrVtx8PHPfiykylDkA8KfqKZ09G0:LH6rVAkylDkA8KH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785331583, "uuid": "52b05e0d-1053-443b-8c45-133166f17704", "value": 3935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785331583, "uuid": "11982978-8b8a-4070-a2dd-e7e9c25fb02b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785331583, "uuid": "65fadc1b-2b2f-4925-ab2d-792d168166d8", "value": "script.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74ee10a-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324549, "uuid": "0a90d99d-96a2-4826-8d40-dc824038111f", "comment": "Malware payload", "value": "7790826cbc180591876e1602065de0b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324549, "uuid": "7f06d80e-53cf-4824-86e8-96b19e8a65b9", "comment": "Malware payload", "value": "994ce8657997d283ab752bf0d48818df0b703b92fbc445923c2088dc422f8dc1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324549, "uuid": "75d39c98-e254-4041-8e3e-79c5830eb0bb", "comment": "Malware payload", "value": "dbf77208abd3c173f838b170eb6ef08bf934ca16", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324549, "uuid": "71e80678-183a-438c-b442-4c1eee79e223", "comment": "Malware payload", "value": "18b08799f9775b3fad86af4d80cc64f601958931500e28d9455562a2cd3f6b78fc01a860e0400d1ebc134906afca81ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324549, "uuid": "f4115641-c3b6-4412-8365-a1977d8a339b", "value": "T1E721B7CAC1A2ED95DCC72075F4CA492E9225446EA30F413CAF5501DAB61B74DDB86425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324549, "uuid": "9523dcfd-da89-46ee-be73-1e6e25857ebc", "value": "24:9nqYzjLRtX2Wm3iomIGpEyA1QUw+U1zKZmkki4P/OINoa5KqxcqC3Ze:9b/LRtxhomXmd1QUg1iTk9ZoiKAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324549, "uuid": "7ee4faf0-84c1-4b9c-b489-a1480fb72bad", "value": 1273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324549, "uuid": "e1989f7b-60ea-4c0a-b42e-66b7e1cda348", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324549, "uuid": "ed4f8f7e-8017-464a-bf43-dbffc437d6fe", "value": "photov_425234711129.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2092f9ff-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320860, "uuid": "ac160a0b-43a7-4d24-a00f-84644b6a2ed9", "comment": "Malware payload (Stealc)", "value": "b1d3605941588587ac6927b78bded977", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320860, "uuid": "e8c8f977-7179-49da-94e7-7179f12bbec7", "comment": "Malware payload (Stealc)", "value": "99cd8530772b5bb986883ebfd09410bfd5328581a3e993472826eda78d6e3405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320860, "uuid": "1b8d1e3d-8ef6-4661-9b91-0f537d0684d1", "comment": "Malware payload (Stealc)", "value": "a85d69f27981bdfee81b8e232056265b94abd4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320860, "uuid": "4d49d41b-cbda-40e3-9761-c6b75171409d", "comment": "Malware payload (Stealc)", "value": "cbaa2cc70583aaca423acaa839af54ca147031c2e8a989403436acb284eddd9317bff1d322bc88c392a0ffe425b3e682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320860, "uuid": "aac514c3-5cc1-46a0-a2ce-52353dcc1159", "value": "T1C746331ADBD845F5E037D47A8D928D09EB713C8A4775BBCF63A1695A0F2B1508E3E302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320860, "uuid": "5267e912-4861-40b8-810d-939d4664c091", "value": "492a5d3560401c2811de048088bf91d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320860, "uuid": "08bb4dbf-7867-464e-ba55-41549c339188", "value": "98304:vCg6wtXClf2ZYILltuuMEl7iwwH63o87TuviVc/82FA/ZRGJepVUtc4xFBSq+UN3:KZk5YILltu1mmNZ8bqIjIepr4xFBSNU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320860, "uuid": "15fe203c-5222-43dc-8a39-c983c6cad82b", "value": 5774778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320860, "uuid": "319215d5-300b-4ce6-9984-9691eee84112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320860, "uuid": "bd26f958-d657-4d09-904e-786e32c733d9", "value": "99cd8530772b5bb986883ebfd09410bfd5328581a3e993472826eda78d6e3405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "600e0c8b-8aff-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785296485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296485, "uuid": "d152f9e1-2f2a-47a1-9d68-fdcc4fd520d2", "comment": "Malware payload (Phorpiex)", "value": "a44f85bfafe3d8011148c51f38f604e8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296485, "uuid": "b18724ce-41b8-4bf4-b88a-c286af3b86e4", "comment": "Malware payload (Phorpiex)", "value": "9a5f306198f54047e7be608395869dc6d6dfc30757a04035c3c422f8c1a3495d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296485, "uuid": "8d1e2a02-5f2a-4297-8944-85b1ab67ba89", "comment": "Malware payload (Phorpiex)", "value": "38dab750a3a216aca66f4ae05e8c0a8e43dd2b77", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785296485, "uuid": "866e973c-7fae-40a4-880e-fbe64c8788f5", "comment": "Malware payload (Phorpiex)", "value": "120009674c6365857da1a99eaa08634cf74374b6e44495bb9248392c028e7be05446eb571923e8337d37d712ab769ce2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296485, "uuid": "817434f3-fed9-40b6-8a87-e136cb99949e", "value": "T1B8823B0FB8424316E1E110B4967696BBD9B9AC7633C414EBF7D44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296485, "uuid": "19d6403d-b5d6-43eb-96b5-30b706c70ace", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296485, "uuid": "22ee7182-8219-48a4-873a-585bc59cd232", "value": "384:A+ZbmcmhzwEUaUu94gXTP+av8U9c+q4P:K5UaF9Ka0U11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785296485, "uuid": "038ffce9-34f5-43de-b375-add036d9c53b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785296485, "uuid": "a9771a23-10eb-4085-b3ff-d50091d846f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785296485, "uuid": "91b33051-c3ae-4d66-9b1e-d14d4370c39a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814b6dbc-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307278, "uuid": "18f58b00-23e9-41b1-86f1-1c563ec7ab3c", "comment": "Malware payload", "value": "87263efe6f9b9363bc2a063ba363c30c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307278, "uuid": "f2644cb9-5c66-4575-b215-92eefbfe34eb", "comment": "Malware payload", "value": "9a8027c753293ca805f61ea6238c81f29a7414a2733b1d0e23be0a9513a41094", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307278, "uuid": "24f813fe-b702-435c-b62c-0348cec9cbbb", "comment": "Malware payload", "value": "855017d7d7efb516d38bf85642bc07235fcffb79", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307278, "uuid": "30ba0d7b-92ed-4a7d-a088-2869e5627034", "comment": "Malware payload", "value": "11c401da9dea6063e9c40aad103806267fa0f3d9c13b4c5a9c84a21b55ba6b4f1b8982eec28da59456e4fdf03c1be9bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307278, "uuid": "ebeca76c-32c3-4a59-bd6d-9cebc4bd5d30", "value": "T1C962C18312AB2C66CD53CF3450A45ADBBDD799C8BDE0A11BBCC803968B1C3395B52F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307278, "uuid": "2d61883f-d0f0-468a-8dc4-451ba9820d91", "value": "384:WLhmMo3i+Sx72PxjGtNUu5SxlQjCce8mECXurc9hpG:WMLSnx72PxjDu5SxlQmce8mEWu49vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307278, "uuid": "c58aec2c-bc43-431b-881e-b7a458f83382", "value": 15113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307278, "uuid": "efde05f2-1650-47ee-9783-9c51cf19c3de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307278, "uuid": "f704e198-4b17-4ca8-a23d-266950d24c0b", "value": "images_20260728_081549.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b009a2-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333166, "uuid": "7c519308-3864-4188-8be0-30daddc8209e", "comment": "Malware payload (Mirai)", "value": "5cb033633cf0a018684467fe7a817b18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333166, "uuid": "2a0c5c10-a314-402b-b4ea-92347629edc3", "comment": "Malware payload (Mirai)", "value": "9aff77873a7ed7bdc8681fb33ff0add725eb8f3bbe03a71cd3dc0f48d25f6634", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333166, "uuid": "f6f9739a-dcc6-43aa-9e2f-abbfbb95428b", "comment": "Malware payload (Mirai)", "value": "bd6442f50387a998a7a11fd1190498e4f5141d95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333166, "uuid": "2957f009-4ce2-43c1-9d93-5968edc0d1db", "comment": "Malware payload (Mirai)", "value": "88427720bcd6948bd5eadb800d764fad66b27dce6e740f82f9459290d613e1c9b4833e28ab4f5a23fd978f686b9250a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333166, "uuid": "a8a89d5f-961b-4546-92ea-0a1a9af672d2", "value": "T14EE31956F8819F11D5C151BAFF0E528E33131B7CE2DE72129D246B747B8A8BB0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333166, "uuid": "434e1848-05f2-49f0-a04e-385e2d0d4c86", "value": "3072:8IuI5EQAFQmVXARgto/nTaKQTvof5S3jxwtoO2wPP1btPTc:8fwgpVVto/TaKQ7uS6tocPPzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333166, "uuid": "5fc35310-805e-4f5e-b05d-4b65fa429d9c", "value": 151828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333166, "uuid": "90fb97c0-8c29-46b6-b841-e117f6ca3b09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333166, "uuid": "1c5bf475-6404-4771-9359-b7ff4fe4a0c6", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17cb7171-8ae6-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785285627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285627, "uuid": "8ab54072-69a1-4800-9af6-154c6cc361fa", "comment": "Malware payload (Mirai)", "value": "3283f939a1ee7b1b9d418555990d299c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285627, "uuid": "ae66dad8-6e44-469f-954f-3f394f87df57", "comment": "Malware payload (Mirai)", "value": "9b5a9954e031bf017324e3cbe578cb7f0148d428ee0172003846bc9486543aa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285627, "uuid": "b76c9300-778b-4079-aca6-ef0112467b8f", "comment": "Malware payload (Mirai)", "value": "d389c6a125b4f0efae980debe688402fb1ec4933", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785285627, "uuid": "1d1f4ecf-9e62-40c3-b48f-c2b0ebacbd02", "comment": "Malware payload (Mirai)", "value": "e09710dec24b4ed8f14526e5ff4831093fe6b20816c4a7cef6f6b3a8ee8d6e9152bb83572c1b30f0f49c8c70b1947d96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285627, "uuid": "2f86e166-27a3-433c-86a6-6e9e52155f2d", "value": "T15124E90A6F510EBBD8AFCD3706E9070129CC955B22A43B357674C918F54EA4F5AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285627, "uuid": "2340a79c-beb3-4062-b63e-ff644f1cd1ec", "value": "3072:sgXHOxgYRsJtAaTcPVCFkqvTfEqwnLrBfN4+DH:sgXHOx1sTAaTbZT5wHBlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785285627, "uuid": "a1a74ec8-54f1-4bb4-8bd0-9b8d90960d42", "value": 229148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785285627, "uuid": "7a9292bc-d3c3-41a9-a6c2-3f591e583421", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785285627, "uuid": "0e3ca6d8-174f-4d0f-a492-18d19b22dbf0", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2c4812-8aee-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785289046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289046, "uuid": "ce0930ff-3e79-4e56-8adc-91cbee473105", "comment": "Malware payload (AgentTesla)", "value": "9452ccef2ed2f38e61bf4f1838c5fa13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289046, "uuid": "66d035a8-09e1-42d2-8c54-579df0aa2894", "comment": "Malware payload (AgentTesla)", "value": "9c9dcacd3a247c7860113f842cf920b8cfa205431c5f1e40747c774ba13069d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289046, "uuid": "2267664f-4ac1-4a85-90bf-0a972ed31c0f", "comment": "Malware payload (AgentTesla)", "value": "288348b56571068fb11a0579de46e84d3097f2da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289046, "uuid": "363a274d-ea96-4c9d-ba56-1e9a449052a9", "comment": "Malware payload (AgentTesla)", "value": "828babbfb86f52fbcb68fcf6bfa6101955ee79ce78df12b12e0e7718731e5251ec6f2bb7a9c77272179cfdef6543cac4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289046, "uuid": "05e58e2b-a3db-44fa-9ffa-643c37e1ae54", "value": "T198750AB7872A13408B74D270463A8A74FDA886A10B8B5C46303DADC4AF7B1D5C75FAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289046, "uuid": "29cd2554-5669-4555-aacd-c45d23a44bb4", "value": "768:4ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddv:EfDFdO/b67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785289046, "uuid": "f29c535f-5dec-45c9-ba03-d2fa80300749", "value": 1688794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785289046, "uuid": "4f1d2bfa-d291-4eb9-b1a8-62a47378f073", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289046, "uuid": "c12ba0fc-3558-4da9-a086-7ba3de38696f", "value": "Revised PI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7dca6dd-8b34-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785319450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319450, "uuid": "fc57c092-8d1c-496f-83c8-c309488068f5", "comment": "Malware payload (ConnectWise)", "value": "752003e4a9082b6d53c162cea6405613", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319450, "uuid": "74b1266c-d8b1-403e-b5be-9b8a2d961bfc", "comment": "Malware payload (ConnectWise)", "value": "9cb003eef21a9bc4b40536c667f65ece28f9d77665409908c81c3d64995f828b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319450, "uuid": "8fb05e6c-38c2-4b6c-ab32-c7c74a792504", "comment": "Malware payload (ConnectWise)", "value": "3f8a52157426451cd4d232301b600a757915b404", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785319450, "uuid": "c30a44e1-fab4-4b4a-89da-1a2b2d35b245", "comment": "Malware payload (ConnectWise)", "value": "2f6351628164b30c89d181fe549f930ab920cbd0005ab9490e227d4b2e08ed10ecf143541499d9f4d362b9e37fced6fb", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319450, "uuid": "f58a263f-4f11-4b17-b879-cd777979ccb3", "value": "T190A623216BF88174F1FB2A78E97D80B14A36BC648A26C05F0774395E28B0F54D6B6737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319450, "uuid": "fd253242-06c8-4315-a452-5cd15ada4ff8", "value": "196608:knCtVYqI5MvbWEpKkq6IJqKwnCtVYqI5MvbWEpKkqdnCtVYqI5MvbWEpKkqEnCtO:wCXvI5MvHx2JmCXvI5MvHx6CXvI5MvHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785319450, "uuid": "eb2edc0f-e280-4476-83d5-b6a4d3384a07", "value": 10190848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785319450, "uuid": "8fc86089-fe8e-43b0-9a30-e2cda0025d83", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785319450, "uuid": "6d0e7e0d-86f5-4e39-953c-545aa3f4249d", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a991efc1-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324526, "uuid": "fd17b7ad-07f2-4570-8d9c-6e2a18257592", "comment": "Malware payload", "value": "909658d8ed94ca6fbd83eecb609e4017", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324526, "uuid": "02ca5d4a-491d-4563-95ed-5152cae78d26", "comment": "Malware payload", "value": "9d652945421add47e3f0dcc5d873854376e1739ed45260237094c3f48a5a3982", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324526, "uuid": "af85cb65-5915-4b6c-8191-d1904852a687", "comment": "Malware payload", "value": "29055432a458dc5fbc085c8eaabe76c788ad4acc", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324526, "uuid": "2283b263-d1b4-433e-9e3a-dcaede82b8f4", "comment": "Malware payload", "value": "a25c96a58d0c0ebffd0f42a716f5d05e6270c8f5c18686ae3657b1b04ca8be2a25970e2eb21d32bdb939bacfe858d5d0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324526, "uuid": "707c3a92-41c4-4b4c-b39f-5c651ccc11d0", "value": "T16D21E76DCD10E05BEBE0E076742C2AA88B8DB0B6562187EF71760505AE071327B130F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324526, "uuid": "a9c74279-ac04-40e1-a88d-aa00f4376f97", "value": "24:9lS0AJ2MaAn+3W5nMeSzpAXRRBNtXDFmkt3LbW3sW8xf7ZgE1LJs:9lS0AJ2M3+03SzpABRb5FTt3O1uf7Zgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324526, "uuid": "2b3a33d3-a514-4a67-b25c-d289b8d11ab3", "value": 1296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324526, "uuid": "3ba4ed1f-15b5-4155-829a-dbf332a5fb46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324526, "uuid": "7e858051-b78c-47d3-8bc2-bdef525ee517", "value": "photov_147613231191.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4cbf23-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785320910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320910, "uuid": "f07ada89-ce40-4e04-abde-e2f940637526", "comment": "Malware payload", "value": "6908e14321351e2ff8facc3e0d596006", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320910, "uuid": "72b59459-d007-46ee-bcc6-e22cfddf2523", "comment": "Malware payload", "value": "9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320910, "uuid": "1acf37cb-bf92-4dbd-a322-e9b9175df636", "comment": "Malware payload", "value": "71c63e3f6074fce186aa208f0038dbebf650d05e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320910, "uuid": "886bc986-df0b-466d-acb8-f47085a743a2", "comment": "Malware payload", "value": "adbc0325ad535685d516d3b93017e82c83bf108e6ab2d42ffc68a8869e74dd15fcc7161bfd8a5e6c9342364cbda05b28", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320910, "uuid": "7f075958-e4e4-4807-9023-778e27edf00a", "value": "T1B2816D243532861BC7C430DEC8588F644B1E266D8198ACE6D29AF70065AC7E894EE4C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320910, "uuid": "da9e3661-b03c-4557-bb5c-675dcbbb3b3d", "value": "96:u2e9RwpgLx9+o0MTjw/6RPZPcgQZ8cTbGwPdsRIBO3+0Vbim2eE:u2Uao07CPZ/UlmOE+O39Rim2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320910, "uuid": "1949d298-1f03-4a31-811d-d011bc60f808", "value": 4084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320910, "uuid": "b1654dc2-16dd-4c60-b068-b4f56bee5ac5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320910, "uuid": "cf049080-2208-486f-8065-0cc459150387", "value": "9d81c29ec25c73da97aeac0b1070a01e4eb9e7c310597ce70c54221eecf9ee17.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f8db725-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307168, "uuid": "8e31b94c-39f0-441e-bb77-c2d503443bb4", "comment": "Malware payload", "value": "4b623d301e2d674a2a3f43716b435e63", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307168, "uuid": "cbc64963-c704-4ccc-94af-11c6b87e61c3", "comment": "Malware payload", "value": "9ecde5a4dbb09cbb4e06205fc560a5fb667b66bba5e318f5805e4b5c638d0613", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307168, "uuid": "a551f9c7-8223-4fd2-ac11-48197c65cbf2", "comment": "Malware payload", "value": "d8f5b9b5a42a70ac4b6c4475768d6865a33fcfc8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307168, "uuid": "b91455c3-b30c-45b1-a1b3-59750a3f7d70", "comment": "Malware payload", "value": "70d00b7823987e568c1431dbe09b5b005f42005f24c968ed81561920651098b0369fa5512387f3046332e85b9b2d7983", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307168, "uuid": "51df01a3-7338-489b-a0ba-3e9a7db36fed", "value": "T12B72C0D8AB39FD19C42344FDBF0DA24E1FB50E25876245A0DBAE128D766E213672704E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307168, "uuid": "1620818b-9a66-4f16-a622-c4b4d45849b0", "value": "384:hlR6I3RfSusSpodtThG+WhcjHGbULptbsPVwprozITmr:PVSusSYhG+0cjmbOrbsNiuIyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307168, "uuid": "22b496fe-8a79-4fd1-a172-2d8ff6a90511", "value": 16770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307168, "uuid": "3d86e30a-e0b6-4c68-93ad-b52525f09877", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307168, "uuid": "8db99f85-4cbe-49f0-b8a6-6bf14b753c58", "value": "images_20260728_153055.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3759375-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333106, "uuid": "39480d91-50e8-4ffa-b667-928b3bbcee0a", "comment": "Malware payload (Mirai)", "value": "9a5ac31ff875d0a631566b998fe036e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333106, "uuid": "2ecb921f-e91f-4e19-ab80-2f38510b35d0", "comment": "Malware payload (Mirai)", "value": "9f917f01cffa35d3a539039367d68c82b06b15ef5a46f6ea1740dfc8aa7cb009", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333106, "uuid": "da4b079d-9e85-49cd-9f6b-5a74b03fe669", "comment": "Malware payload (Mirai)", "value": "c76343084a2717f3bb5ca9454d1a352d9beafd6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333106, "uuid": "5b4418a5-ea58-454b-b1cc-80ff409ec086", "comment": "Malware payload (Mirai)", "value": "3419ad6f79497503d9eb94c09374dbe3b0d27d5bc9de7f28d2c7eec04cc750c98a4f752fc2dc382aafef62ac3ec624e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333106, "uuid": "e8bdce97-ba1d-454a-b859-948a01d82eb3", "value": "T13B645A33656094B4EC8A01349BDFE371DB9ABCA71646F7061FC96D533E578E22B0D222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333106, "uuid": "cdb2998f-1a31-4ba0-8b28-cd8f4fb40729", "value": "3072:J8T5do7gTaF1aH3Ze9B/mFW1kgVmClqNvmf4eutReSVve2M4PscFLnHj8ZTqPm6T:JW5VTI1acT+FWNRIvWMtXu4UctjxLgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333106, "uuid": "86570b85-56a0-4abb-81cd-279e774f8804", "value": 321408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333106, "uuid": "a8533611-6477-460f-a467-e041c18d83c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333106, "uuid": "e0818cbe-7e3e-4c4f-82f4-2e9a6932a4ed", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4749cc15-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354426, "uuid": "9e21e7e2-f81d-46fc-b21c-062689f16846", "comment": "Malware payload", "value": "01ca373cfe9d3ef889aa428177d045a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354426, "uuid": "d2fb9d9b-8779-4640-987b-e2a2c80b2b8d", "comment": "Malware payload", "value": "a01634a49545e05dcb1624aec62184f1f45c9224e4d356d191971914a4668a5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354426, "uuid": "82f02ce9-0da5-4fda-960f-911274138037", "comment": "Malware payload", "value": "36ea122f42d68a773ea5be1a386eb203a309334a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354426, "uuid": "d957bb86-89ec-4442-8c55-79ec694c45da", "comment": "Malware payload", "value": "04ed06caa5ba3d4f8f66df41af3e4ae2452072dddc5b2ec999fc7bd20243e5c5b3bb24c7ca59661d152203ad9bbf0c86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354426, "uuid": "6c459364-2798-46e9-bae6-8566aa6160ae", "value": "T1AED45B5238D5149AC13782F2CF93E1749713FC781DA4852FA2CD2E165F0AEA12D63AF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354426, "uuid": "d8c7607d-98ad-442d-a2e2-93952c577943", "value": "741f0bf68a28ce3a873985d135617016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354426, "uuid": "3a1dabc2-9d57-464b-a90f-88ab03af2f5f", "value": "6144:IXfpmxRVpsvPF50xj8niAhoDsAiv5pTGBNN9hR5wKHqj6f3rdJhnt/eGWv4r4BMA:IXxmQvDiUXTsN9hMjsLeJMqj4zWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354426, "uuid": "eda277d9-6b82-4008-9b2d-0b65f2f13de3", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354426, "uuid": "75d6f56d-ab43-40dd-9d80-b7050e2c48a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354426, "uuid": "cdd66a43-6972-4eb0-8653-8e2897330a10", "value": "a01634a49545e05dcb1624aec62184f1f45c9224e4d356d191971914a4668a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e528824-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307327, "uuid": "35518326-39eb-440c-85e4-4607eaba9a37", "comment": "Malware payload", "value": "0b356970b07669a5d05d76fbc315959a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307327, "uuid": "8c6c1f8c-3ff4-47e0-8e9f-7fabc0a78532", "comment": "Malware payload", "value": "a038be9d71c6972cb69e672a271a80ac8bf2866e65f862574b908cc078859b7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307327, "uuid": "b9b09fcf-0e7e-4b20-85eb-9ed8422877f4", "comment": "Malware payload", "value": "9a7f870efe9ba2b6bb544711d80e4deb79451fb3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307327, "uuid": "a99b2867-e154-4229-8f4f-c5969fc95c3f", "comment": "Malware payload", "value": "fe4720129c5e334650caf06f2abecc4447355a747c895df069569e5f085b39f866e67bf9e98bdd142989755f7257190a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307327, "uuid": "f1d9d3ad-12e3-4357-8ae6-006944da4820", "value": "T1FF22B0CB4E14C0B7CDF52EA950A97C0EB53A24658945BB51A14E3A0D74C71B8FE4B05F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307327, "uuid": "bc0da0de-1922-4418-a56d-768d94961960", "value": "192:CvJHrBxIVw5IAwCUmjgAq8W5DLD/DF9dfg69UjokR7iEw6pWgvxh/yMvHnaj4u2E:CvJLnI65ILmjgAq8WJ7F9dfB9UjjRmDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307327, "uuid": "5120d823-23e8-4019-b454-269c632bfd1d", "value": 10285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307327, "uuid": "523b80cb-60c4-453c-be63-d1bce65c5c9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307327, "uuid": "b060f751-ba96-466c-b831-00718bb50909", "value": "images_20260728_234608.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af525a03-8aec-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785288458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288458, "uuid": "a9f3821d-1c9f-479e-b58a-366f73f9493e", "comment": "Malware payload", "value": "276e9e960593b4a8a547c88c572f15fc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288458, "uuid": "a346b4ab-dc8d-4c1f-abe3-47d8bce5596e", "comment": "Malware payload", "value": "a046184ae4efc3f09a283a3c24d1533a191d05dc843c78534c3f129ceaa9946e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288458, "uuid": "59e42739-aac5-4bed-8bcc-0b7c2fff4cb2", "comment": "Malware payload", "value": "846df1a2e8606cd4d41f419f60f2a9b4d5a6e478", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288458, "uuid": "15376b39-808d-48ef-aa8d-5f5cf8401028", "comment": "Malware payload", "value": "2c56aebafed76b7cc1385d242b932fa80f26925b2a47498171cf3a12c3be91bb8623188097f0b92512579daf3860234a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288458, "uuid": "b0becea2-21a0-447d-9cf1-45a5e1cb89b0", "value": "T1F2C27C966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACC618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288458, "uuid": "85bcbd89-06fa-4cc7-9081-03b92d72c62c", "value": "768:c8vCB+25j6es8Rs69FYpMSUpi+20qUpi+20YQX:c8l25Jssd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785288458, "uuid": "7cbca9da-5d62-4195-b684-0a38a2225115", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785288458, "uuid": "dda39a83-a6d0-446e-8e48-dc00fe9b2cc9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288458, "uuid": "3e605dd1-558b-4cfd-96bf-7134efce7388", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f71335b-8b17-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785306900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306900, "uuid": "6c876e10-9393-400a-a625-e7daaf9c16c4", "comment": "Malware payload (RemusStealer)", "value": "02ca9583237646ba46c8699ff8ee6ff0", "object_relation": "md5", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306900, "uuid": "feb103b7-4ea0-453b-9017-a5294622644f", "comment": "Malware payload (RemusStealer)", "value": "a06ca2f848c977ba268366038cfbe8f696c0e25424001ff9cff2271c5a16a258", "object_relation": "sha256", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306900, "uuid": "0f3be76e-227e-4dd1-901b-8dee1a46007e", "comment": "Malware payload (RemusStealer)", "value": "02572cbf8264c437758d834c0aa5409b941aa353", "object_relation": "sha1", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306900, "uuid": "720d5697-b476-4035-9fac-99760edc5792", "comment": "Malware payload (RemusStealer)", "value": "c0f77541f69a145af33e4a4c37b568532ebfccf6ced3bb311fae8c0ffd526e8e2968e458e19b57cded72744e6612ea7c", "object_relation": "sha3-384", "Tag": [ { "name": "1TEST.file", "colour": "#584C71", "exportable": true, "hide_tag": false }, { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306900, "uuid": "fc61872f-4579-437a-958a-0d1adddc4b1a", "value": "T197D52B203BEE6198F2777E36D7E67595DBAFB3722A06CD8B1001434B0652902DE87D39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306900, "uuid": "24aa6744-0e5f-464c-96c7-6ce3f6334e58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306900, "uuid": "99623296-11f7-45c3-83fa-5c3935770fd8", "value": "49152:3x7UsX7w1ZeuIpQxnG1cVT3YOzKKFbW81XxznCI:3x7zLwOuIpQNG1ATAKJ11Xx2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306900, "uuid": "7e031491-8c14-42ea-93bc-41558d98f8bb", "value": 2928640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306900, "uuid": "cd08870e-fcd5-461e-9be6-16ee57b8417d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306900, "uuid": "c3534350-cd8d-4337-a788-43517fe61feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de5e7b3-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349766, "uuid": "6e924ab2-c0bd-45a4-82e4-6a6b5953ef6e", "comment": "Malware payload (Mirai)", "value": "b815c33384b12a393b960e7cb554cf25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349766, "uuid": "77eadaef-855f-41cf-af5f-aacc319779bc", "comment": "Malware payload (Mirai)", "value": "a0b1d4c8d3356aae2caaf6030c7eed821794f7b32bcdc538f7960865856cbec3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349766, "uuid": "189a07a3-0662-4d89-8953-22a71246cd25", "comment": "Malware payload (Mirai)", "value": "97d316cd48e1022c27e4352269e319c48a8bf52a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349766, "uuid": "0463c55e-72ba-4253-992c-dc97e8043a44", "comment": "Malware payload (Mirai)", "value": "adfe1018df808ad8192fa7dfdd880ec8d302fd513116fc2446297409680b285f8c8ee91e7a52d4a2d692122cc7460d64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349766, "uuid": "471126d6-b369-44e3-b4e0-16fce537088a", "value": "T1A15302876F83D9F8D393B7329E8C9AC9CED94BD5231F875B0884D0B684646193B44B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349766, "uuid": "56ed6332-45a5-4773-84b5-8d03ee47b0ec", "value": "1536:8+kUPnacPHui8sXbJNNvayDsmkk4Xe87fqzr9CQPxEDIX:B9LNtskzr9tPxxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349766, "uuid": "7e9e2fd1-afc3-4d0b-b58e-d428ae461d98", "value": 64828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349766, "uuid": "507581d2-1e5a-49c8-874c-6fb183e60004", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349766, "uuid": "2a3f532c-b058-416f-9aee-9d029e59d633", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f791184-8b99-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785362734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785362734, "uuid": "7f466a25-f3cd-465d-9f89-b8b97ad0a803", "comment": "Malware payload", "value": "0e19a698ed7c3fb9664c52891973a242", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785362734, "uuid": "7b74a8a0-df18-49a4-85b5-474ffd705f90", "comment": "Malware payload", "value": "a12938970191659c4b45d3aee886c6ef9b95f1e02e78eb85c71343f4a1e8cdd6", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785362734, "uuid": "0df2f4d6-98d3-43ff-8d18-67df24a29cf0", "comment": "Malware payload", "value": "d2f083c9214fb0cf01466c06940ebc536beb4d0b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785362734, "uuid": "6fa9ded9-e6d0-4741-b37f-db0f040625a4", "comment": "Malware payload", "value": "f060a11e006c3d3b47acbccbbdf0347b788345d5ca57444af07318332981eaf96e43fab979791e0f8a503c06e169ff1d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "masgravr-shop", "colour": "#761377", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785362734, "uuid": "bb5b2085-5df8-467e-bec9-555a0488b1ca", "value": "T1668633CBC6E0E7DB2624BE4F63A01EDB655C5391A812E0AA324E7748DC05C5DB72F931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785362734, "uuid": "75f71748-8cfe-4edc-9d69-b6f44a83308e", "value": "196608:BfA2ypyPGru3zYF8sxiVUv7tYwWrxOtbZXJStVB6BRGZ1GKR7syDm:BfAZpyer6zu1xthJIV8O1GKJnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785362734, "uuid": "9ead3d47-6137-4eaf-bb40-10143bc7b75e", "value": 8445267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785362734, "uuid": "e200aa57-a25a-4e4a-b0e7-c28a30a6938f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785362734, "uuid": "9e539b23-d61b-4700-82ef-9a9de6587847", "value": "662a80b0194fc616144c3a312a215faf4f78a5671ed978dc6796e581d9fe7d4a.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a9cb6c-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785358819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358819, "uuid": "6196f815-56c2-41c4-b0de-796b06474bf4", "comment": "Malware payload", "value": "d1ff75a46b2acb5a4355a3294d79e6e1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358819, "uuid": "e589c85c-e729-4a1e-a2e4-fdf914e26486", "comment": "Malware payload", "value": "a1416a250bf7219f95961f484421dda844b5013b5561c4a40591489dcfcdd384", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358819, "uuid": "509883ae-c259-45e1-8ba6-e2a66e46a115", "comment": "Malware payload", "value": "12660cf55d5523314ce8d40e1407e4f6862597df", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358819, "uuid": "75a6fcd6-187f-4bc4-8418-3a73215e26ad", "comment": "Malware payload", "value": "b9443b7714a0aaaafa55dcdf5546123a60b33cc27d2df9a1d742cbffa6210ac247602795a05a805f9297bba564e438f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358819, "uuid": "9e212faa-229d-4c8b-a426-4868aa77b247", "value": "T10486225AFB48D85EC4B3133646765566410B1C66CF83E7839A90722C2EBB9C44E8BFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358819, "uuid": "6d59619a-58e9-4a3d-b1f5-92cf98eacbdc", "value": "196608:p1fK8qG7CRhh5m4fMQKGFbl2z4f3yxCnXzqTMo+mdR/:pH76hy4fM68zAmQHmdR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358819, "uuid": "de785046-d998-498f-b9ed-6fadf0ed8dc1", "value": 8291109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358819, "uuid": "bbc235d2-c210-4ade-b99b-33baf73db04c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358819, "uuid": "223ab197-6251-4c1f-8d41-e5c88d81e482", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca8d2db4-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351640, "uuid": "e1c89d4c-ca31-49a2-be9f-836863aa0026", "comment": "Malware payload (Mirai)", "value": "4c2c78bba82201aa31524ce0a11dec5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351640, "uuid": "66c8e3f6-6d3f-4d53-82fa-57058bc9e351", "comment": "Malware payload (Mirai)", "value": "a1ffe4eda93f409d5a9182986247dcfea399341b2c5ff4960a2f976be64b9ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351640, "uuid": "5afc4e34-1d4c-4ed7-ae07-8e940fab617a", "comment": "Malware payload (Mirai)", "value": "493e3e95caad7494c233b5cfd6f9b2a5e2013d41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351640, "uuid": "7a03a3e1-b494-4714-bcf8-4d24248eb3c9", "comment": "Malware payload (Mirai)", "value": "f6e6d852aa38f6780fe3fa8f67d4670827c199403c00b0ea4fcfe6b5c6eca570365fa9101aa7be29d47736c7a3fe2d07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351640, "uuid": "4f4bed5e-49f7-4a61-adc0-64660a1c7287", "value": "T12A43F27831E4182BDDB01539EE6F19936E602871D0B63277DC34159C76A266FCA23B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351640, "uuid": "a37d18ea-ca68-406a-afee-b046384ba826", "value": "768:bNFrpSos9y2DWRZyV9IcPfbvXJXpY95rzT+COP7IFz9yib/a2bU7DFLs+g2M0s3G:bZy9y2UcXbhpY9JYPEFZbaqkDW+gxzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351640, "uuid": "5f9c9b62-7b5a-47bf-b7a8-f1b9f6b3d7a6", "value": 56156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351640, "uuid": "90c7e08b-4efa-4494-9fa2-2b6155c847b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351640, "uuid": "9f7bb8d1-d612-48f4-af15-0612f6978726", "value": "zero.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fb58ac-8b84-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785353561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353561, "uuid": "4e2daf3a-244e-4bc9-a916-32a86c8828f6", "comment": "Malware payload (Mirai)", "value": "ce4846fef2fbeccd49e6c1fc35481276", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353561, "uuid": "5a6b2110-b59e-4e09-b9d8-c656899becca", "comment": "Malware payload (Mirai)", "value": "a2a67bc564e7dae8ebb3bf87368df309c1a5cb80b007872adc294e5da76106e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353561, "uuid": "0abe7b24-11a8-4a46-9869-c5863d307e79", "comment": "Malware payload (Mirai)", "value": "63fe070a14ba6d01ed9e49f4f9dce6fc2f2a7854", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353561, "uuid": "dffee58b-d261-412e-a355-8eee33a1e8c3", "comment": "Malware payload (Mirai)", "value": "9d223a8cc29d8fa5feb7f6271427c061d9085fb1e0d4aeec6e72104ca2ac7a71b377a1076f08fd903ffb7f288fb85746", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353561, "uuid": "d970c65c-f11f-495c-a64b-c7c03ccd044e", "value": "T138730981BC80AA2AC7C01677EE6F509D3300A7D9D2DA3742DD581BB4BB8E81F0D57B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353561, "uuid": "0417641a-5d20-4739-a8ee-b95b555b642d", "value": "1536:x5onZdJ8XbE/V9qlMyEDqTUuSDzcjl8t4VEc3Xgx+:xGnZgXS8DGz484qiQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785353561, "uuid": "97321ee1-be93-48d8-abc5-23f1222b6c0e", "value": 75044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785353561, "uuid": "fcdeed56-51a7-4644-918a-b8de21e501e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353561, "uuid": "f70301f0-9b6f-4950-b6f4-cbf90d960d8c", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2949033-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324595, "uuid": "ebead98e-0eb8-47be-b1f0-3ff68d54224a", "comment": "Malware payload", "value": "6a1a15c25c6fba007315c5aad9fcfb8c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324595, "uuid": "a8b3ea61-bc1c-4a45-aa19-dde4a818b930", "comment": "Malware payload", "value": "a33bddb753434ac6021a2c32ad9a2e050addf6cc150da04769a3be64081d5e51", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324595, "uuid": "ebdb0e9c-031a-4e4e-a97c-74541136873d", "comment": "Malware payload", "value": "64c1f610603177a3ff36b78a9a595d4a5f8275f3", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324595, "uuid": "6f4cd7d6-926d-4d73-9f1a-6c595d422343", "comment": "Malware payload", "value": "54930f8ae14f5b818a4c0c320fb0f7bdc321ee85032de5f303db52ffa752fb1fb61d4e6f7f1ea78cae20f568c19221ef", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324595, "uuid": "0916b828-85e3-45b5-97fd-c60e8a67302c", "value": "T1B421B4E6C1089856FC6A7475B9F8825B20163CB824CC3EA79219893932C85F84F4FDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324595, "uuid": "7dadedd6-8890-4d7b-8d08-182955844fcd", "value": "24:9iSPDK7EcJcGYpNN2hI11h4XpJ0oR2DmkrtubjeY1uPb5zbvec:9iSPm7vcGYx2h0hMpJqTrIbkDlbGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324595, "uuid": "e3f291ed-0b3b-40be-b05b-b71b131e48ef", "value": 1232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324595, "uuid": "a47fea76-752d-4d36-a92a-59f25b05c098", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324595, "uuid": "fd57a2eb-af2d-4713-931d-39ed18904238", "value": "photov_027853836618.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d495da59-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313861, "uuid": "652ada91-ce4c-491d-8322-a605cf194c17", "comment": "Malware payload (Mirai)", "value": "94f68d287cf0f90655a9c439f3f9a933", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313861, "uuid": "2550b20d-31d4-4892-ac6a-9189d0ad9e82", "comment": "Malware payload (Mirai)", "value": "a3d28aca0da85ac7673ecf637a9b5ec87609e1abadf3b92c07730cdd2ba3fbea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313861, "uuid": "0f8460bb-be64-4d22-9e64-d8f47caf97e3", "comment": "Malware payload (Mirai)", "value": "c02faebeb4d9ad0a47ad1886f1d44e1578a9cb40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313861, "uuid": "6181d114-a722-4932-88cc-c7139e239b30", "comment": "Malware payload (Mirai)", "value": "997e81a71277d2de086bd37583d1a7a8a6d0685fb10bf38b7c4dbfc62225cd7bac436b4aab8fc3329d276faaabfd6e5d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313861, "uuid": "1298ddc5-9f38-45b4-b3e9-9fef5514bfa5", "value": "T169233AD0E643CCF6EC129570113EAB339FB5F837102DEBD7DB669922B853002A91699D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313861, "uuid": "31024a12-f0a5-49c8-8414-41eedaacd887", "value": "768:jinOdo/g6/vEFWkXakMN/CWBPPzOe124nEyFZxSHFYU72:jqOILvEFWkXa9LqAnFzxyFYUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313861, "uuid": "7692892b-1249-4a12-bb57-7470c1ecf1eb", "value": 46420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313861, "uuid": "f9807276-9506-45ed-a2d5-afee774efcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313861, "uuid": "cee8ffb0-4847-41b7-b710-fb95aa9239ea", "value": "real_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70175eb-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333648, "uuid": "0b36c27d-b8ba-47f6-ac3f-09807d54d1dc", "comment": "Malware payload (Mirai)", "value": "6ff36abd0ac3f4e64698f36fbb810791", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333648, "uuid": "d08eb703-c2f9-4450-a6dc-3ae74c52b05d", "comment": "Malware payload (Mirai)", "value": "a4c8e913b89b45b64ee0a252b106388f28606cc5ac29779bcbad4b8dbb156646", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333648, "uuid": "2d7f2e41-ff8f-40c9-9ab7-cbffbb0fcc64", "comment": "Malware payload (Mirai)", "value": "3b1b496e79b2afde88bab76f0c9cd19f23c00a61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333648, "uuid": "67b1dec1-147b-4f7c-be74-b2719b498bce", "comment": "Malware payload (Mirai)", "value": "8b8406fa4b767fe5bc4cb154cc28f6924a7dd86bcf8a5b544ef655ace8d00b047856a68185269639351d36a4409e6dfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333648, "uuid": "a28c3ce6-90ed-4b35-b8c5-248be4192601", "value": "T1CD43F166824141D9DEF69DB913D84B8909B20EFA3403AC49BCB3E1C5ACA5FC07853EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333648, "uuid": "bb17244c-3263-4abb-b092-34e714ef419c", "value": "1536:7/p+YTbyHyKtdgePFpge0gS4EyxM2EIbnUrFOBRiOX1IEU9AVJuI:8YSH5tdgy9SDyxMMUxIpFTVQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333648, "uuid": "17700776-a827-486c-ac8d-ef9f18916bb2", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333648, "uuid": "bf3684d8-66f1-4d48-ae41-1025888c9914", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333648, "uuid": "26d9fae6-55bb-486a-a6a1-b2a1a9d312c3", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24778097-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350502, "uuid": "dbf05fc2-ea15-48be-a318-9709beb79b71", "comment": "Malware payload (Mirai)", "value": "5803eabff8597ce417ad388ba99ab611", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350502, "uuid": "42111e8e-a4fb-492e-9df4-d32275b2a984", "comment": "Malware payload (Mirai)", "value": "a579f41e732ca4cf5205595cf9a6844d9508e39e5f2b23d7d65f41ce7ccf81a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350502, "uuid": "018b95f2-8e42-4455-87cc-f40109603ea4", "comment": "Malware payload (Mirai)", "value": "889363de8ca057c05667a4cc1aae545326556958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350502, "uuid": "fec4e497-c610-4c97-89c6-48a6d83beb06", "comment": "Malware payload (Mirai)", "value": "1b54b93925cc14c65a3c9a0bfb4e42a15c47ecae8c368afec240329f2ae0d128f9d1367cb75fae91dff5e4dc4f61f5db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350502, "uuid": "70181090-f901-4732-a965-0bc0e8a4fe51", "value": "T19C24D70AAFA11EBBD8BFDD3305D9074628DC644B22A53F757274D928F50AA4B07D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350502, "uuid": "671708f2-19f6-4dfa-9eac-c55dd682f368", "value": "3072:A4Nlxgg3ORU27YsBfc/4gIK8enX7oX2Ci:A4fxgg3Oy2hBfc4gIuX7ZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350502, "uuid": "df6aae3b-15f3-43ae-be81-80893af6ab64", "value": 222484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350502, "uuid": "4a052e64-f892-42ec-9eca-1ccb792c5e63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350502, "uuid": "3c872b72-23ef-42e7-b9d2-bf0f42382a81", "value": "zero.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71466fab-8b8f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785358362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358362, "uuid": "ee2c23f7-2230-4b1d-8380-5b24887290bb", "comment": "Malware payload (Stealc)", "value": "db05580a540923fc9018705a62224a36", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358362, "uuid": "bb7910ca-df39-48cb-8466-249aeaa49c12", "comment": "Malware payload (Stealc)", "value": "a58cdd282196a800054eabccafbecbbf5a4eeb6a5a7a925353d7901dae0db9da", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358362, "uuid": "5cc576f2-96a8-4582-b36e-37dcaf5b5595", "comment": "Malware payload (Stealc)", "value": "26cd2070839628f53add0f11f9352cd95bb134ef", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358362, "uuid": "9a996f0d-7589-4bae-aa57-8cd5c8fa15eb", "comment": "Malware payload (Stealc)", "value": "9c21364ef4ed726c6b04f9d5b0697bb5ccd7ed11321a085fe6f2ea27e89b9b0814b82780e720cf3b414082116eea6ebf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358362, "uuid": "969a6ace-af82-47c4-b76d-1aca3b442ad9", "value": "T150952392A1D82269E4F6533305F143136F31BCA57BB60ADF15AC396E0F635E0E2B4B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358362, "uuid": "43ae5e13-019b-49d0-a721-a9abede09c20", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358362, "uuid": "b6268b3d-c7ec-4757-b9ba-e751143040c8", "value": "49152:Z/hN1OaNOBOxcTTqZnK1MvMY8WOYXQCQEBy/wE:FzxcT2ZaMvf8IAClWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358362, "uuid": "823a85df-cd5f-48b4-a538-17f2f28ac0f1", "value": 1953280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358362, "uuid": "3e98109f-ca11-407d-a8f5-47f4dc1263e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358362, "uuid": "6e63f516-ab09-4c46-b138-514fa89a753c", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267a707d-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323876, "uuid": "1ad6def4-6330-44a0-a733-1ac6cc725284", "comment": "Malware payload (Mirai)", "value": "9f8695d9027cc629feeff4cace0ddd7e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323876, "uuid": "1fa165ba-ea3b-481d-94ed-73bda3678ee8", "comment": "Malware payload (Mirai)", "value": "a5e14c19f1f736aa74a7fea4cf60dfbc22761b71cb24b64bbd77c0bf3fb1d0c1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323876, "uuid": "57b2f7b3-1534-454f-9bd6-b521e3b5e4f6", "comment": "Malware payload (Mirai)", "value": "06bc492c11709f6250c101468b9082c2139ebea8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323876, "uuid": "842fb0a1-86ea-46c3-850a-7a36918aada7", "comment": "Malware payload (Mirai)", "value": "085ab84d3fe58374fecf762253e659a157570529972e6040faf39a4f240a19ffee3f1c5de6db046c8be5f614faf36140", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323876, "uuid": "18d1b9f5-773d-4e34-9f06-4a516b2a3964", "value": "T151833B9AB4019E6CF98BDAF940224E0DF93163415B530F26A76BFDE33D620A5DE06C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323876, "uuid": "de1f7fd8-ee6e-4109-9b1b-e76a4a6c5c9e", "value": "1536:Qg8Bj6jeSzhScH6cfOBaXgkWkTO0QGOtWnkMtnzbBJ8R/H:iIScacfGwgeT8FYdnzds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323876, "uuid": "6d6473ad-49a5-46ab-b740-9bb186571e04", "value": 83860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323876, "uuid": "a1277eee-09d6-43a3-9093-b4a055952a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323876, "uuid": "358f266a-481f-4a94-8d9f-e045c2fbccee", "value": "MMaaRRiiOisecTanee.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70af931-8b7e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785351150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351150, "uuid": "2d9a6a8f-fb2b-4ac1-b0a7-49a21969a94c", "comment": "Malware payload", "value": "fb52e944c7d2c7ef88c1fa2bc49bca8d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351150, "uuid": "b074ad8f-5926-4a22-b0b1-9fdabc71de73", "comment": "Malware payload", "value": "a698fd443f31acb8747f8f8a33460eb04952bf3437ff0e07236207acace850e8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351150, "uuid": "d6aa67a6-e6f7-42a3-a7a9-95887bb1bad5", "comment": "Malware payload", "value": "2cbd1b25814007055d72bb2373ae5d3a15f6f891", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351150, "uuid": "2d3ae100-2b86-4277-a0aa-7a469fb0fdf6", "comment": "Malware payload", "value": "4f7c8ed4439a8ec9c47e43ee54584922b764766660d4006f6e90e6585fc786d391cb98b380434929d819bf7573e4940f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351150, "uuid": "d5e2daee-084f-4bc6-b0d5-42cbc8f7a00a", "value": "T1C2E6335C5ED002FEEAA3513DEEE26646F658B4660772C9CBC7A887836D132C15D3C623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351150, "uuid": "98e4a900-491a-4fb9-9441-ba84b2bf4b5c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351150, "uuid": "b018b54c-fde2-4cc3-a67b-1f4322a1e20f", "value": "393216:Aif0d5RT3wNRYbu9upJngXMCHWUjXjcuI3/PGTAI:AJd5uNRM44xgXMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351150, "uuid": "2bbaf221-9270-4bdc-a201-48a9b488a936", "value": 14281270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351150, "uuid": "bf0d8cf8-5c25-499c-944c-70558641eddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351150, "uuid": "52ca4f1d-19f3-4d1d-9dc6-0b3f733825ad", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b32d039-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785310624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310624, "uuid": "bbb951d2-4a5a-4d46-b47e-21bf7d3d76bb", "comment": "Malware payload (CoinMiner)", "value": "44252f444fc4734a732bf6da9f62bfdb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310624, "uuid": "e5747eff-57f7-411b-962f-24b6d7eaad9d", "comment": "Malware payload (CoinMiner)", "value": "a6fbff58f3f4137fffa2f0d046343f7245c4a69ebd79df25aa2d2c0197af1a94", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310624, "uuid": "9305a0fd-06d9-4d9c-991e-96684bae1cd6", "comment": "Malware payload (CoinMiner)", "value": "b0dfbac5fd63ac178efb3bd88db5f81bd37d3bb4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310624, "uuid": "e82e9821-940b-4291-8c28-65263775888a", "comment": "Malware payload (CoinMiner)", "value": "2338251a5015f21aa98754efdcc07ffeaa371fed26f465522ef4f79e1d3aebd1e5d7de62d5516abb181ba98962fc9245", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310624, "uuid": "bd49597a-3fda-4a4f-83f0-eabc66eaafbe", "value": "T139F56D0BB6A254BDC1E7C430875BD563BE35B85942217A7B3680AB302B77F205B1DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310624, "uuid": "46bb2f7a-dbfb-400c-a263-1957abc8959f", "value": "49152:p1sUSxvwRKkAtlbt5GlISwfIgXctkBgJqngq+VDxJ9iKKNKta9EzuUwTWs0BLZzD:2xSKfx5AISwKXaCATW75naDoRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310624, "uuid": "c38d9f6a-c173-402c-91f7-22ed2c392886", "value": 3389232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310624, "uuid": "9d7b532c-9e98-4ca5-9a73-ee4d9de51ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310624, "uuid": "9c31e0b5-e67a-4f74-a470-b93649a8692f", "value": "a6fbff58f3f4137fffa2f0d046343f7245c4a69ebd79df25aa2d2c0197af1a94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15b2b6c-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307413, "uuid": "b43d05ad-f7a9-41fb-b52a-a259b0f2f608", "comment": "Malware payload", "value": "46569e00bc7448fc5945de04e8f1596b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307413, "uuid": "33b69464-abc4-4935-8fd2-2581d65bb480", "comment": "Malware payload", "value": "a91762f2e84a425e9f71c13c658b508e15fafb82493902479e2cf3c53e4e3dab", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307413, "uuid": "9751512c-3546-43f9-8258-309909354fa2", "comment": "Malware payload", "value": "0dcc644432f68498b7530000d8bd015c3ba3db90", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307413, "uuid": "3365544b-f70a-401a-95b8-9ed1540fc996", "comment": "Malware payload", "value": "50ba1903ffa3515904cfb2a830c78b63ea3de309e8c67dc71d3454130af9796698b3f0972033714279ed8416c3fa1969", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307413, "uuid": "fd0a422d-465e-4fd9-95b3-b8a6e51673e2", "value": "T19CC18ED68E409F2BD6CF9CB8B7D65DB0A39DDC5332959CB3865ABCC453FA0856203844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307413, "uuid": "2f7e4148-2b8b-4396-a137-14f386dc6092", "value": "96:bG6fLQITpphBpW8R8rKmsgaxrw61b2t1Kb2E7qz0/47FHyt/BfeHrrwlD2Bgvt9+:NjQKpW8R8r45w8S7KR2zLFHy1Bfe3KTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307413, "uuid": "5f18c502-e9b0-42c9-a816-8446d6d906a1", "value": 5725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307413, "uuid": "f02cbfca-acc7-41b6-aec6-48e32b0a7b94", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307413, "uuid": "491b9638-2c9e-465d-ae0a-3aa90732c568", "value": "images_20260728_162547.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fde0028-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324483, "uuid": "54103f92-d157-40b6-8c9f-a32c880276ef", "comment": "Malware payload", "value": "c319f7cee21ed508e51ef1991f492459", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324483, "uuid": "d210986b-ee8c-4fe5-b865-9ef5105d798d", "comment": "Malware payload", "value": "a9b91ac8c8162ad96cec334b084c787fc490bd35b2490f6762fd52cd8083b9d9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324483, "uuid": "1420d44f-33b4-4892-a546-357713c0270c", "comment": "Malware payload", "value": "54650ebef7222d7c176f959604a818faef99842f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324483, "uuid": "730d77f5-bb57-4fb2-93e4-9bbf93e6e8b0", "comment": "Malware payload", "value": "f1eb2e56d734a194b8a9cf04a27280655ed9b004b58fcb8eb1e1b4caac49149d1416823814955a86affe1ccc72eaa14f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324483, "uuid": "1dfc0f27-f9bc-4545-9bc9-1e8affd11433", "value": "T1F33108EA089DE036FB1731BB34012F4258232E3D08526AC31B1C870A972A6B59F217B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324483, "uuid": "ec5ec244-e201-49ab-a343-1e87bea106e5", "value": "24:9jMowRLiERXt+reaT72PT+7fYISMQs5bmkHZdibW3sW8xzTreyWs72Vw9FH53:92ZDJIrmSbYI9Qs5bTbr1urnWih3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324483, "uuid": "73c3aaf1-3b08-42c9-9721-2463337867de", "value": 1451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324483, "uuid": "20b2112c-299c-4996-99bc-87f7334d232c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324483, "uuid": "bb01b6dd-e0b3-4a29-ba9f-a741426d6d96", "value": "photov_974474742058.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de79ee9-8b65-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1785340317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340317, "uuid": "b3cfece0-a7e5-4814-b901-dd1aedff83c2", "comment": "Malware payload (RemusStealer)", "value": "d6d9e71ef20eb564c30cf0f92d038ce7", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340317, "uuid": "9001f737-0df0-4d76-96ab-6cc42314a53e", "comment": "Malware payload (RemusStealer)", "value": "aa1e87294fdee8bb644eefa9d72dfc8751aec4aeb47104edaf83447f397f3802", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340317, "uuid": "0a86edec-fa0f-49cc-b6ea-e8659fec7bc0", "comment": "Malware payload (RemusStealer)", "value": "0666d21f95ec1a12279e3efc99f9a47d698af46b", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785340317, "uuid": "f5a7b2b7-1b1b-430e-aecb-2492fcb657ba", "comment": "Malware payload (RemusStealer)", "value": "1d60f176183081b1a5eaabb16b99ce92039ca23316d8e0b8d3a6bcaff840bd55c1741d44355bac9fe874b324303dccfd", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340317, "uuid": "0e814b98-1911-48ef-9ec8-86dea0dadb98", "value": "T1CCC56B07BCE148E6C4AAA33189B316457771BC491B3623E72EA0BB782F727C09D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340317, "uuid": "8d1e9e82-9b38-43b6-b138-35f64ed5f782", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340317, "uuid": "a1a3114d-7ea7-44b3-845c-cddb3f71dc66", "value": "49152:2ycAVpoDk1G3MBPDPkVOSmeERyEKZP5GmFt1nJlNTMG2e0xRBVt/x2pjaUZ7mPGI:2yRpBcJCf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785340317, "uuid": "f7b72412-6660-4010-956c-1e79b50df375", "value": 2660688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785340317, "uuid": "7036b596-7294-4104-8a49-b93dc53b1e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785340317, "uuid": "2f2230f5-67f4-43ec-9539-3fdb7cbec0cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0c25b8-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351776, "uuid": "d16274a9-0f18-4da6-8d64-41d214479e1f", "comment": "Malware payload (Mirai)", "value": "f731bb59964f62c08e00e9375855d2d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351776, "uuid": "43a39345-970b-4e12-acdb-70c2c0d3225f", "comment": "Malware payload (Mirai)", "value": "aac8a487f9297ee2fe85b2a96d70ca018c597df314657eaeb9701b730bc8c956", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351776, "uuid": "c530d974-7b64-4bbc-bf17-f12bba6e7c1a", "comment": "Malware payload (Mirai)", "value": "b39741be901fcfcdb18e86e6ae5ea5dd1f468382", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351776, "uuid": "426434fc-7db0-4787-b1b0-f99b551af07d", "comment": "Malware payload (Mirai)", "value": "55e05a6ac56451e957098fa5259b72c439263425fec548617bb4c7f85e46aa8f0f8769b8b63e3b8386651528f6f8e00e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351776, "uuid": "9b40066a-5d1f-4ea3-8f4e-2bd880ab4122", "value": "T1C7430283D20A1C66F5645B32467D430AA39A6DBCE8FF606F9D0F909D5CC71E4837906B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351776, "uuid": "a8b54732-e66e-4907-9e51-4ab76753e472", "value": "1536:kbawx9y6HetnW3I9/IU/k+XqE0pa6PYaDPL5:kbaMIK54pttqEWpPTPL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351776, "uuid": "a70d4fe6-e811-4654-8ce3-8cf22b08fa95", "value": 59940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351776, "uuid": "91b73657-85af-4add-a7fe-d2e3a6dfd030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351776, "uuid": "a8e204a2-9c0d-4338-984f-118c61ad33ab", "value": "zero.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1adc8174-8ae2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785283914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283914, "uuid": "5e975ad2-7942-43fb-8644-d50b395f6fce", "comment": "Malware payload (Phorpiex)", "value": "c57f426fd8099b5a14b1415a2394b92f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283914, "uuid": "a5e38a42-4581-4733-a3f0-598aa1567ee9", "comment": "Malware payload (Phorpiex)", "value": "ab074ae168e50392c6981f6bf426900642c684b13f72b4de681e0b9b4cd1a55d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283914, "uuid": "ca3bc182-2c7e-418e-b5b9-128dbb3761bf", "comment": "Malware payload (Phorpiex)", "value": "0e1bdba547ebff6804278358fc98fa8e2f867b8d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785283914, "uuid": "9e2dccb3-3e22-4c9b-b764-1527538fc4cb", "comment": "Malware payload (Phorpiex)", "value": "243709d2d79aff6cb1c56da019fceea9eedd3b2fc5948ab3ec5195b582816ec1eb9f43b2ad60c616158f821c9965b35b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283914, "uuid": "a8cca163-f9c6-4229-8de3-1fb1464bdd2a", "value": "T110624C0BA4808035EBF14474927F526648FEACB623C5F9DBF7E0648A4AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283914, "uuid": "02cb2b0f-d729-446b-bedd-e613eb7fe43b", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283914, "uuid": "a30cc16b-2672-4c43-b01c-31a69ff4d046", "value": "192:AWtsGnjXgjk8LcRI+IdJDMBIfeF5oIV1BKUSfEzQ0X1d1gJxTmv8U9cth19ik:AUScqpferoFEH7yav8U9cfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785283914, "uuid": "89d5653b-156a-45a7-b50a-b37695711071", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785283914, "uuid": "c426c13f-51e3-40bd-a953-ca9f6bd2bd8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785283914, "uuid": "0fef28f9-9d20-45f8-9114-bd58c36b9d30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7c505d-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333040, "uuid": "627d45c5-2d28-4990-ad80-7250a0a73db4", "comment": "Malware payload", "value": "a9a0078d6e8e168e8d3e445cd8eb1e97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333040, "uuid": "1ca38fde-dd66-449d-a131-cb35191f0161", "comment": "Malware payload", "value": "ab89c48a4024030bbd3b73edd83f50dc8c4db63ed9d1193247ccf791feb7b19a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333040, "uuid": "b8861f44-4fd6-42a1-94c9-c89dbf2ca012", "comment": "Malware payload", "value": "5916e652e35616485115ffc2706cb0716c19b74a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333040, "uuid": "441059fa-8439-4ced-b323-6d93030b9cea", "comment": "Malware payload", "value": "7efcbe48ed6e44a54d06caae65ef0339e2d213e2e8261c481fcb1242fd41aee3e10099ffceaa6486ef4c9798cd98cd1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333040, "uuid": "01f22b20-70fd-491d-ab68-9fe2c58f604b", "value": "T128264B83FCD12A95C4AA8231856B815BB9717C581F3423DB27E0F3681F73BE06A76B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333040, "uuid": "2022447e-1837-419c-9b60-0a63a2b4f8d3", "value": "49152:nvhT7teqv8FZehk2J5Vj7cuT4VlfPAluB6M3LjnQW1k0iyLWhsPj:nv5tO/725jd4AmYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333040, "uuid": "edb5be2e-2b0a-47e7-a1b0-562d6d6160a5", "value": 4680232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333040, "uuid": "09a65b3d-cc20-4a2f-9f31-883edc89b640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333040, "uuid": "cecc0c0f-e5ee-416a-b695-de557735a8c1", "value": "chrono", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d179e64d-8b37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320727, "uuid": "e3784852-4093-4225-9716-aebdd4dd62e4", "comment": "Malware payload (Stealc)", "value": "f083f2fb778ae8f6d9424fdc04a41314", "object_relation": "md5", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320727, "uuid": "5c748543-ea50-4624-91fd-7e969fad232a", "comment": "Malware payload (Stealc)", "value": "ab9476466cfead369f859a5336e557ccb5b22bdea09d3c245a91e9c305623427", "object_relation": "sha256", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320727, "uuid": "4e05db6c-dd37-447f-abe8-ca4a35518510", "comment": "Malware payload (Stealc)", "value": "bc9cf7c701094986e732cb2b2cabb882bdcf39ec", "object_relation": "sha1", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320727, "uuid": "90d0e301-1cee-4157-b483-5011ce76ea6a", "comment": "Malware payload (Stealc)", "value": "519c64134015e9f54896954ed41fcf90f885758c514aacde553b403a74ab95cbf2addd7396c41a41bcfc0a5e7ad2e41d", "object_relation": "sha3-384", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320727, "uuid": "8aa79e8d-0b8c-4bb7-b7a6-daf6a9b58171", "value": "T1953142614543F69E8FCE92FBB8227F08763D6F4362D46200E715CEA4DD4412D686B2E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320727, "uuid": "12ee6d46-6535-4536-803a-3d9f0a19a736", "value": "48:P8e68FTq1Be16Ie2q6u285E1e5tDzGnVCAzS25+U:PRFgBg6IO6uae59zGnSE+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320727, "uuid": "20152629-8317-4170-930f-32bfb28a6134", "value": 1852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320727, "uuid": "3db0db41-429f-4edb-ba83-509fc80d4eac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320727, "uuid": "9e5f9c81-86c1-4d06-aaeb-581296912408", "value": "sleestak_payload_1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae97850-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307402, "uuid": "68b0ba26-58b8-4203-aeef-606c1adeec24", "comment": "Malware payload", "value": "08e3d32539c7e989ef78ecdff3fc703b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307402, "uuid": "b4ba8cf0-ecb4-418d-a43a-6139e23af959", "comment": "Malware payload", "value": "abb6b0f913a1f0d591ec92e302fa32ad717622255c1f511be2fe14253c95648c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307402, "uuid": "d29de612-02c4-4b24-821c-9be6890ca978", "comment": "Malware payload", "value": "8df0e0af51a1c81399b2c1b3c80293009ee0458b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307402, "uuid": "f114f8a3-7a5d-4017-aea8-579932aa0f53", "comment": "Malware payload", "value": "3534a68373fb2ad276e13844e3a0aa9dbe47cd7b8363f7fb6ad6886bb2dd3823e11c3eb9cb5ac0ea256b1c4940121704", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307402, "uuid": "9d98fc0f-a672-457f-80a2-f203e3b142b5", "value": "T1FDD18E7FE08194ECF9BFB670BE8DBF9E14351D48BA4F9444651837828EA100BEB19506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307402, "uuid": "701668e4-db81-4251-863d-cf7f453769db", "value": "96:/wedz6V5V/oN+QvU5A8BfjL7E7xE9f7hVzRNqLSyXWAxKH+QF3bR2cEj0W:/756Ng8QvUlljJX9NQ2lHrDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307402, "uuid": "3208d1e5-9d62-4e01-a774-e7a7c36cfc8f", "value": 6292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307402, "uuid": "532a8e50-fa04-491e-9a96-2c9766e12cb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307402, "uuid": "cd17c362-ce4e-4d57-8534-cae95d88be58", "value": "images_20260728_085040.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b193c3-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333510, "uuid": "f94c66fb-94b0-4cd6-859f-528befe5ddb7", "comment": "Malware payload", "value": "6044c50df19aef84c556172984267ba8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333510, "uuid": "f0ccd820-caed-46ea-b001-f4edc003c29d", "comment": "Malware payload", "value": "ac08f4de2a47aa64d78f1844d326d6822f1fc17dfc040ef36ee5a1028f326a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333510, "uuid": "70124774-3c6a-464a-8721-05d77a4c49a2", "comment": "Malware payload", "value": "e6ca231037197506c9aaa61d56b07d0e13a08674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333510, "uuid": "6692f520-4ddd-4c73-b3c4-3359fb2de7c0", "comment": "Malware payload", "value": "909235d42e9dfd7db787ca67718ca79296f2665b8532b2f0620fd25baa1e9d0550ac015512b6724cb8677a9279e98600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333510, "uuid": "987ee3fe-7ae4-4cda-bfeb-79c321a3acb2", "value": "T18528CF02A3E88599C0BFD139D57B550BE7F2BC695331D7CB1180597A2E73BE04A3A362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333510, "uuid": "09bcfbe2-35fc-4aba-af4d-47bd2f349771", "value": "1572864:52Jzwbt/z+l1zAxJorsgdnen9qPsniUd:4Jzwbtal1z0ysge9qUiUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333510, "uuid": "ca1c92ab-367e-4483-ac83-6c58148c1c4b", "value": 95983616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333510, "uuid": "3781717d-c3d7-4580-ba68-2dd495e614ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333510, "uuid": "60d3b2a0-cd04-4ef0-b0cd-f2ec45aaf417", "value": "TheWifeSecret.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0fd1dbc-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307332, "uuid": "d995a4fa-6298-4421-b54e-f3a0b31b7d4f", "comment": "Malware payload", "value": "fedd1ab798f2ceafd2977a38c1c855b1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307332, "uuid": "e2bdf32b-5496-4066-954c-9e99d6bfcc2f", "comment": "Malware payload", "value": "acf3ad112e18553196d10908e936199550cbc511fd820b7ddc721766057597eb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307332, "uuid": "e4118fd5-d607-42fa-a1ab-9f065a222f17", "comment": "Malware payload", "value": "88ec6c30bf50f3eb518d9f34a1475ab7d3d86553", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307332, "uuid": "b1ba3716-3620-41cf-869b-6a23649fddfd", "comment": "Malware payload", "value": "7db87fe14f7d96b2d7320152c3c5d85a6c38c4e14c39b4b9890e6af35226197e494fbc9b85b73d6edc80424f0f2727f7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307332, "uuid": "7633dd2a-e680-4f6b-ab67-98362d618725", "value": "T15A22A073CD4A094BD32B15BB3D50ACDE84F8B128F2D59E69B4ABFC40D9FA95C2205500", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307332, "uuid": "457746bd-c960-4b59-b1ec-3c24e80ccccf", "value": "192:emFVHeiEYyRZj+PrjC9v6j8QNDqziMDNRrRcdFCJ0mldN5ks:f/HWtr5XQFAiKRNjxldrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307332, "uuid": "7058d020-e965-4939-b75d-ae99777522c4", "value": 9991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307332, "uuid": "7feccc42-b7b6-47d4-b40e-0ccfc6fa5bd2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307332, "uuid": "575042a4-47ac-4a15-817c-75c75645ad58", "value": "images_20260728_101151.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0313266-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352481, "uuid": "8f36e713-ad15-4eee-9ef2-1f9224d6182e", "comment": "Malware payload (Mirai)", "value": "a00d7ad4013d1c2f4236732cbcdcfb8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352481, "uuid": "b3966da4-6fb9-40b5-9b3f-08f366931603", "comment": "Malware payload (Mirai)", "value": "adec57e91d17360a84d443ec280165e6c00aa95e7664e70d7332bf7a4b4e0e70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352481, "uuid": "8f033520-d68e-49d5-a04f-3f7fb09ac88e", "comment": "Malware payload (Mirai)", "value": "ada830434ff17368af94c60be3de921f4b16bb49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352481, "uuid": "7c0023d5-fac3-43a8-8b91-2782418fad04", "comment": "Malware payload (Mirai)", "value": "e9088b56ded8d037be37d63202cf97945a0b23a40c98c96fe7870e269a9a10cef2aadbd01ecc72fcae7937254ad3a25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352481, "uuid": "df2ab57b-1a55-4056-9000-ea1bb41f12c5", "value": "T15C43F11296B92F01DDDE993ABB80DDD463A08F09F7E18DC420FD0D857912A126EA7EC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352481, "uuid": "f3840575-74b3-4195-91e9-0c9bb379e13f", "value": "1536:i+q/OvpV2Rn1e5aJZuyo623NJHGzrSLN//4u+qgw09H:L0OvpV2Rn1L58JkeX4u+qgw2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352481, "uuid": "7dabac69-ea7f-40ec-b3e1-0af7a2c0fc2f", "value": 55572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352481, "uuid": "c135f93d-7ff4-4730-9c5f-c6bea4041ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352481, "uuid": "39b44e05-a7cc-4071-9265-673fe9c70d49", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa301db-8b19-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307670, "uuid": "31ddb2ac-eb8c-4360-8917-5fef11a60c4c", "comment": "Malware payload", "value": "1f13c097ca8af615950cf819d3e72621", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307670, "uuid": "e7873aec-2cae-4640-bcf9-07e553c6c8c4", "comment": "Malware payload", "value": "adfa87d9c55472a7f671068681da6afe3d8d1019e70a397ddfcb3785d5870d42", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307670, "uuid": "1f5d8afa-f697-42b2-bff9-5981fd136a4d", "comment": "Malware payload", "value": "7884c0ee17fddc6425f14a5c207b5175e24166d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307670, "uuid": "d8e11da1-bdca-4068-b9e8-cc6d28bff43b", "comment": "Malware payload", "value": "2267f8e5aad2b6c798eb9bf15e9ae52ae89f6d8273cfa60d8e0489c43e94f123aab866ff6f3ec88f1748623957d98c15", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307670, "uuid": "596ee4ea-2d72-42d7-9cf1-874faa9922b1", "value": "T1E5236C6616857C24AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5A69DD10872D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307670, "uuid": "04565918-069d-4248-9a50-e168a47f08fa", "value": "768:AXRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:UlxQcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307670, "uuid": "be2f8655-2df3-40bb-97b4-0bb28e273c37", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307670, "uuid": "45411c66-b913-4b31-9207-3b3df3eb6a13", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307670, "uuid": "bfe96693-9b31-4b0d-afaa-c51a705ed871", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28eaccbd-8aea-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785287373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287373, "uuid": "611db79b-b2b0-4e68-9e0e-39298c92e11d", "comment": "Malware payload (Mirai)", "value": "f11e121f524d11eb1bbd8eff4f6399eb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287373, "uuid": "803ac392-5bbf-435d-9a98-4eb1317cf249", "comment": "Malware payload (Mirai)", "value": "af03598bef65613ab2c8a64fed066b9fd384d92da2fda23893b80ad5887812dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287373, "uuid": "ca6ced68-9628-4b35-b539-6c7a61a612ee", "comment": "Malware payload (Mirai)", "value": "2cd5e21ec078bdac860ccc25e72f5caef05a0ec7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287373, "uuid": "057df44a-1e19-4e2d-bdc5-35caea7e4b6f", "comment": "Malware payload (Mirai)", "value": "72c5a66faf61ff5bca3389f53287ed3590cd48fdaa734f16a436705e5979f38102cc4673c2528f6a5418eb02cd0a0565", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287373, "uuid": "d8e9aab4-571a-49e3-9189-785b4ff2ca49", "value": "T150016FCAE250D5504059C55EA69F5290B421C3CA4A8B4BA47FDCA43DAB5CF14B037E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287373, "uuid": "5a3563b2-08d9-496f-aa4f-462d8dfbe031", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka7ChsTBQCXbl8CNWs1CdXs01CdaauD:kXCKysE2hi0ziQvZoha7FOmakWwu1Ea7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785287373, "uuid": "bf10fe0a-16a1-4f5c-863f-2ccbfbedaf30", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785287373, "uuid": "b717f9f6-12c8-4677-a6b6-a2dccc0abee4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287373, "uuid": "56267140-3fc0-4dc5-aa66-5ab987046676", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aba3644-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354458, "uuid": "567d65f6-9b93-4430-9c00-673b72fdc50e", "comment": "Malware payload", "value": "c1ed84cdb056b981f901ffa5f1c7b4d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354458, "uuid": "29c273ac-7916-4c43-99d6-b59693ba90e3", "comment": "Malware payload", "value": "af5a2f1b7e388d4fb49d72e8f453fda673472ad603bf72aee4869a34b37f535a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354458, "uuid": "ea89406e-bb10-4eb2-8036-ef7908cb4300", "comment": "Malware payload", "value": "c420aa7625a990af7b93b58ec24aa3ecd0a4a679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354458, "uuid": "38bf02ea-19f7-48ad-94a2-1f0486f52fc0", "comment": "Malware payload", "value": "be7298c0d6ca03fe78a8969cec0b9842f1d4c81985b6d2cfaf410a171f9a21f07d7a8712a0624233fc489335876dba64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354458, "uuid": "cb0cb6be-220f-4692-8d6d-76b42be55f2b", "value": "T124F38D5BB3A510FBE0779638C9630645E776B81107609BEF03A4427A2F237D19E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354458, "uuid": "e2b5fc51-ddf5-45ac-abd1-f3b904445da9", "value": "5c9da646790c3ac480cd4ddda3f760f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354458, "uuid": "9814932a-bce8-4ca0-9334-3cf67ae4dbeb", "value": "3072:Z83TfPFAz6pK+u/euY5Zn1rjlHnvNj3FE71+nw+:ZufP86JQGZn/Xnw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354458, "uuid": "4287a3f3-ecb6-4647-8f77-8545b6ff3f31", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354458, "uuid": "d1b25d49-551d-4fb6-a050-261c96aa69de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354458, "uuid": "dd399a5c-745e-4924-8207-42b106ed29a8", "value": "af5a2f1b7e388d4fb49d72e8f453fda673472ad603bf72aee4869a34b37f535a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4ff6f9-8b3d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785322999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322999, "uuid": "aada0253-a9fe-45e7-a633-34ee516b74c9", "comment": "Malware payload (Formbook)", "value": "143154ceea75f57098d287291c155dfe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322999, "uuid": "61ee6ab5-de5f-4e41-9489-9d4b6acef4a1", "comment": "Malware payload (Formbook)", "value": "af71b2c0fa2345a5e46ce52b14f9e3ec658b4e195105c73f4443c79da7e286e8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322999, "uuid": "bc18571f-49e1-4399-b7c4-893332dccea2", "comment": "Malware payload (Formbook)", "value": "e68cde19da2ce7e034125e0bd50ddbb67c8e08d1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785322999, "uuid": "fc96b58f-dde0-41a6-a7a9-08e6f963f455", "comment": "Malware payload (Formbook)", "value": "ad85d06ecc3c1ca3b5760032060eec0e37fc7eb9e75c52607a93e7be5b60aac62266c97adf5b60339651d1768392b6d2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322999, "uuid": "f1cf1c61-3562-47b0-bb2c-65aba7eb893f", "value": "T1ADE3728AD7AD82B9C246A8730CA5014D8CF91F37F09649B4F4BCE1863BAC11D577C1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322999, "uuid": "b3fb8821-5993-456d-8fb1-893cfb5c5d62", "value": "768:fetb9ps+i8WfhsgPnRwY+yxogTByLfAVItkck0:WtY+dE2iEkVIto0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785322999, "uuid": "d044decd-bec8-405a-a846-b6ba2b41e2b2", "value": 144039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785322999, "uuid": "c398d1c7-3e94-4806-beb8-8c9b04d78852", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785322999, "uuid": "43a47a87-2847-4cbc-99c4-b5a7232455b6", "value": "upz.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70bc323-8b2e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785316791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316791, "uuid": "3fa2a5c2-1b85-4c09-a6ab-183d9ed57590", "comment": "Malware payload (AgentTesla)", "value": "e58096a9cfbde64c357d48c1bde9c908", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316791, "uuid": "cf2a5ece-8469-48fd-bdbb-255d5cde735d", "comment": "Malware payload (AgentTesla)", "value": "af9675e75f65e5b6e422306955c8b2b93c2ee0dfd53fbe72cc81e9eab11b701a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316791, "uuid": "7f463f25-98dc-4626-9adb-4cda6435eb84", "comment": "Malware payload (AgentTesla)", "value": "7d674efb36c4c55dd9337a22f64301cfff95f1a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316791, "uuid": "2bd4e888-7190-4bfc-bfaf-a271c7d1266a", "comment": "Malware payload (AgentTesla)", "value": "6288f4711ee0409f8c3693eafdf04138b211cde1de286c42511bf0e4ab8f7e5ef435adf3219f4ee4ca0431ecf88a9da8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316791, "uuid": "2062f1a4-40da-4ace-9519-f3d092d4e180", "value": "T11EC32A60D92506774F87BB9CBCA40660C57DC329892705B0FADD8B0D920A9ECF77D26B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316791, "uuid": "3caccf85-3248-4f6d-acab-c432ee64c149", "value": "3072:AUQDrAuFBakBX0P6NW3NjGzyF/UagTrFJ/u1FHvYSp:AvQKakBXo339GaDgTr61FHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785316791, "uuid": "d0145d09-87f7-4a17-a386-b092ca6ed666", "value": 118461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785316791, "uuid": "cd85e9ba-a62c-46a8-9be9-dcfd95092c58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316791, "uuid": "f11bf924-c9ee-406f-9aaf-10026228ac03", "value": "20260729-000581.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bbef85-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785350293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350293, "uuid": "26d183b9-ea73-4c6a-aab3-b7910c5c3a12", "comment": "Malware payload (SalatStealer)", "value": "970a40aeb1cc1f4269aaf5edf091dcfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350293, "uuid": "8a3de9f0-b10f-47f3-bb6b-574163120485", "comment": "Malware payload (SalatStealer)", "value": "af9b05c7311f0f4049467a64bb1484b2264955faf61b19e8974757802f197177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350293, "uuid": "ab92d738-e5dc-4d8d-8b7f-31596f91c174", "comment": "Malware payload (SalatStealer)", "value": "33b9451a2c9c771ab3f453e11b230fdd35f04019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350293, "uuid": "d8523dc8-8782-49c4-b45e-12c7b0f35133", "comment": "Malware payload (SalatStealer)", "value": "bdbc357daa4622a93975e03ddafc2a7766ad335a1eca8ab283190897d071ec281657d74fd355249f740a515ad16c9fdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350293, "uuid": "92984b06-df98-4153-8870-fcc9350178cf", "value": "T1BD473358C7B51CA6E660C93B31A4790A7E0B6E60F951DA336D8393F3857BD811BA3073", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350293, "uuid": "b18c48c4-5fc2-4411-917c-1d2b159678de", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350293, "uuid": "469f7a86-86c0-42a8-9f13-a18b1efbdb80", "value": "49152:2db9kFqB6NAOm5ETXqwFVdwz0xhMzwnyRxBSy/DdT2/3RDf6ao24fcKdkIbfuE:E9wedPWZwYsQyL/DdTuNf6Z2+dkIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350293, "uuid": "bb10649a-77e4-439c-9d60-fbbf0c937e3a", "value": 26212704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350293, "uuid": "2f25d210-8dae-4856-86b6-87e6f7ac5ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350293, "uuid": "ce4e61a1-66b9-41cf-896a-3331adbd61f0", "value": "Xenor-v1.3.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f1cbc-8b12-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785304767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304767, "uuid": "b1f53d40-5e68-49c4-9cb1-1d1e3ef0f317", "comment": "Malware payload", "value": "d9a9267b38a6d9a85cf0288baee99024", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304767, "uuid": "7dd38c90-cae7-46b3-a84e-9f4ec971c01a", "comment": "Malware payload", "value": "afb5c92086b2f08afd2d1b89843474439bba739e4ad1831908a3d2f15f4edaac", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304767, "uuid": "0ad8e007-012f-4563-86c8-389c37477fc7", "comment": "Malware payload", "value": "c6d3703f56bc5e77a9301fa89ac1feeb26453d03", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304767, "uuid": "31f29bfa-9ebf-4a30-9fa0-43121ed7b5aa", "comment": "Malware payload", "value": "bbda82a242d4460e632671b94c21eb0679b034f44f8c4bf5d2fc5314fdfe81e4d40820627bab6a6bf14a0fd677a70176", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304767, "uuid": "7bf83ce8-1e4f-4521-a473-2d4e5e9a2768", "value": "T19931B0151BF64318E7B79B38B8B6B6315937BC05EB25CAAD114041482C61521ED7DF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304767, "uuid": "427ff69f-e417-4959-966d-7f60fbf51d92", "value": "24:8vit4mD6EtJDvldKRKhMWaAFUPWn4+/CWM8HlctjDPGPaPNMHYqVAAz2Jxcm:8vLmOcBNDJi8YDOPaVMBWAqJxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785304767, "uuid": "45479aa0-469c-4e04-8a4b-7199a3897e9e", "value": 1747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785304767, "uuid": "85197415-06e1-42ae-8d7b-dd106e54730c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304767, "uuid": "8e88255f-4cae-46ef-8b7a-e0da09450d02", "value": "afb5c92086b2f08afd2d1b89843474439bba739e4ad1831908a3d2f15f4edaac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3a3abe-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351585, "uuid": "8aadeb4f-b439-45aa-94a5-5316c6ebe170", "comment": "Malware payload (Mirai)", "value": "402e22c0200b7bc059ba97074baef502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351585, "uuid": "dd49e500-e6e3-4ddb-aeb6-35d42eeeb3c8", "comment": "Malware payload (Mirai)", "value": "b0866e9dec2d8ad9d4de1ab717dee5e2a575126ca8a8e1e565c38c61b44f48a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351585, "uuid": "7400dd13-3861-4b35-b6c1-46bf2070799f", "comment": "Malware payload (Mirai)", "value": "0a0d6ad28fef232e320087a7f030c8253fd05070", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351585, "uuid": "87eb7001-5d34-42a9-954f-19844ff54f35", "comment": "Malware payload (Mirai)", "value": "ba6665abc8d21b9b6da6ac21c4127b57ecea5f4e184dd6ecca95c92166bd695a8b4c0c7192e5e9266fd411bae5556074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351585, "uuid": "dfcf0260-c1fe-4b0e-8014-a6a252b432b4", "value": "T159144A99FA0F5D42F1C7D3FCDE4D8BD13A2330E397768AB62D0202EDDAA39954950912", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351585, "uuid": "c1ba4c06-9120-4c18-a2f4-a430a8d39f80", "value": "3072:9caFcYCU99YRrhI7vcSI+3rDf6FdH+n/i4YQKsg7cQjnlZu3r3MkG6Lq:iQAXMT6FdH+/i4C7cwub3Q6Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351585, "uuid": "39f66b48-0f0c-4310-bb02-c17ddbefbc1a", "value": 194448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351585, "uuid": "829f2060-714c-4c01-8524-c041c68ec6dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351585, "uuid": "75a02303-e5d6-46eb-9975-a06ba694a9d5", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f6e87a-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307417, "uuid": "3c4222af-85f2-4ef9-853e-6dac6a5e8bb9", "comment": "Malware payload", "value": "033a35e6dc42e43d77554eaabbf0c468", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307417, "uuid": "bdc0c36f-2ee6-43b4-9d4c-cb3c8fa0f55c", "comment": "Malware payload", "value": "b0ef763f0470f6000d3a7897368df0a32d2d056f3876b65f063da3477becc6d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307417, "uuid": "32aab043-ba17-4986-8d1f-64f601d0e016", "comment": "Malware payload", "value": "0c83376ed1085d5671dc70e9c45f321e9eb510f6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307417, "uuid": "8984e2dd-832c-42b0-907b-9ab225ae3126", "comment": "Malware payload", "value": "59930bb57b2480befa55e8518ab1ba4cc5887f8187345c4fbe4f0ad4143f65c3b72b3e5225e1c75287fe034f90b2a0ac", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307417, "uuid": "357c7804-fbc7-4d8e-a68a-8c03fcde4858", "value": "T196B17DA53290C726E83D4F3970C37CEDEDAA92C2450B7712E39C149948EB715AA2F01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307417, "uuid": "0fd72bfe-a843-4efa-9e84-0aaa490834f6", "value": "96:ljS7YjaJ7mOa+XStbm5H+JUCKNE6xrDakznsQFeSWBUuYCTMk:ljS7YjW6IXrNET6FeSWdYqMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307417, "uuid": "533e5ed9-ce8e-4c8f-aa41-04204291c290", "value": 5589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307417, "uuid": "a41f17b8-a232-4607-af6d-9d897c9a4e90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307417, "uuid": "2ece38cd-2648-4c64-83a6-b6774cbdea9e", "value": "images_20260728_192413.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a12a5d-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352841, "uuid": "0ab8d4bf-8c0c-4b5f-a098-248d7c524c67", "comment": "Malware payload (Mirai)", "value": "387bee10cc8c313cda5c3d717319eb80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352841, "uuid": "e9835eda-32d7-4831-8ae7-4a5304ab9f52", "comment": "Malware payload (Mirai)", "value": "b14e42aa75e85d5e0d14e831bf7988f0e235cb5e1d48255a637dac7548e4a4e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352841, "uuid": "5d896201-ecd0-44fe-9fb0-99491068296e", "comment": "Malware payload (Mirai)", "value": "dff89c9ec45147d4ddc371279fa1e56139fd806c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352841, "uuid": "bfe01e42-8d6b-4e85-88c3-bc18e27994c1", "comment": "Malware payload (Mirai)", "value": "72c999db592ef5464b6ccb2a2876d40a45fa997e8888182df170a59519d8a28fd1dbc2532a5c763d9ad7ade57059650a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352841, "uuid": "f5a5aa16-9884-43d8-85fd-266cf3ec738f", "value": "T1F543F1F3A277E370C61B1AB77E57FD41C62828858A099F1B6DC061B8F5612CCB9302A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352841, "uuid": "4ee1ddf2-a3ff-40ec-a9af-a4ecdf42c71b", "value": "768:5ygEx53yPGEQQWZoodBL75IKld+O8qJ+xEHNhnAugCgIbeBxmF9dYLTUd5lQ7Aku:5nq+n/hodJaad+QJdhnAuN5beGHRdwHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352841, "uuid": "31a56468-79de-494b-8e56-c5c7275d755a", "value": 58084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352841, "uuid": "daded81a-55b2-418f-ab0b-d266b8f18e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352841, "uuid": "27c42a1f-82f7-4e8e-b051-a06cb1091e41", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8591259-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307451, "uuid": "3aa02742-4dcb-4103-a65c-c0f80ebfff20", "comment": "Malware payload", "value": "0b60f49b6b703a4609e4c45d7ee31b1e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307451, "uuid": "a2b4160c-6566-4a42-9d8e-d530783bb182", "comment": "Malware payload", "value": "b192845b5838888510d7f50a2639f035c5229f6795faefcac84cb5c3202df9f0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307451, "uuid": "719e5cd1-1650-4a81-bc23-d5f73e9306af", "comment": "Malware payload", "value": "608a0b39570338d377cfbe6cc6ca72db9c0ab3c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307451, "uuid": "b9dcd4f9-f267-4b3b-a23a-5fb368d02272", "comment": "Malware payload", "value": "9a9f0e941da3248faf4345a6b041816fe52f6061116e597790bbcc6781e4a4713c8fb7083c2f3fc7a32e797a2c4b96db", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307451, "uuid": "437bb9b5-78aa-47c4-a2b7-650a1909325a", "value": "T117615CA902118D5EC5D6303E70861215F87EAB0A02E4B1726CE7C3EC765A128B85DFDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307451, "uuid": "837eb057-a6fd-4481-959f-88566a324875", "value": "96:HOgeupAgDjphCNdZAu/+9E7rgZkbyZM/KgdO+pXh1TNu2OF:uRuG4zCNdZmorQkbjjhBofF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307451, "uuid": "c9732296-6eaf-420c-bc9e-cea56e5bae11", "value": 3327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307451, "uuid": "fed4e5f2-6b10-4360-9b7a-bc798b1bad32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307451, "uuid": "c9dbe5a3-9da5-4228-b5c2-2f53fb660286", "value": "images_20260728_083707.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d4412e-8b7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785349484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349484, "uuid": "d3919296-ea1c-4ec4-8cb3-7333083127e8", "comment": "Malware payload (SalatStealer)", "value": "484f574d72b7e472020cca3ee5392e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349484, "uuid": "b98296df-60c2-4b2b-8401-36a8031f4a22", "comment": "Malware payload (SalatStealer)", "value": "b1c8c2390f909d83d50dfd9380eb7ae96b3a1cf456ecef96b459c5b053087a51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349484, "uuid": "4e97258d-db0a-46e0-a21a-fc3504d5d36a", "comment": "Malware payload (SalatStealer)", "value": "9d8b2e6096bfec557b5dcab9f5af4b803505fc82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349484, "uuid": "5f56765f-3f4e-48d7-a544-e8e73c170e5a", "comment": "Malware payload (SalatStealer)", "value": "5524641a0490a66c1093f32f33bbae4796eab5549b8f34a810a9785f9199eea51da1f43717c4fb55bf872eb644e70799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349484, "uuid": "8fed49a6-2b49-4c60-8c1b-66a831941739", "value": "T163C66C11FACB54F5E9035831406BB27F23315D048B28DBDBEB183B6AFC7B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349484, "uuid": "651ee225-b4a5-42d7-8bbb-747e381a9535", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349484, "uuid": "9a8d8c27-7d3d-4cc3-b089-a4e125846b15", "value": "98304:jTr3FJOSKJobiDRjvO1FShwY/B4fG2IfQEh:vOemRT3hwaBxBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349484, "uuid": "28def5ff-0bfb-4900-81a1-32135fef1e8c", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349484, "uuid": "1b6adede-fe7a-4eff-ab21-df2b0fe7101b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349484, "uuid": "1098beeb-8ef5-4a03-b956-0e8039033ed5", "value": "baritondiscord.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ee4e50-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785358603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358603, "uuid": "ac252c6d-a0f1-47ad-a85a-7303b6f0c9d5", "comment": "Malware payload", "value": "9db07fd7c50faf86d61f44421c8a0501", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358603, "uuid": "3fb88c71-e49e-4b7b-ace3-30149ac96a63", "comment": "Malware payload", "value": "b24e5a844ab93fe8567b9f5937280cad8f3fdd4db0eeddd69079af1e8d7f31b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358603, "uuid": "914176db-ddee-43f5-aedf-751080836086", "comment": "Malware payload", "value": "ced344ac6b9b8c28bfbd0d43c4bd1980aded86b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358603, "uuid": "142c5bc4-6c6e-45de-968d-3a0bf16726d4", "comment": "Malware payload", "value": "1198fe1a687c75038bb08500c8479294f6a7de4c791a5c137b3d0fa3e2dcdb3f33be47655ff0007e7de1051a2781a5e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358603, "uuid": "f29c4dae-62d1-4236-9b8b-2f96333df047", "value": "T133768D17FCA545A9C0EA9231897282527B71BC485B3123D73FA0F7382F76BD4AA79344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358603, "uuid": "bac7a216-2943-40d8-b2b9-65f326b1344f", "value": "98304:LdCmWRxMJBtyBoEJC+0ALz6f9sTe/ifpqXLBIHFZ3:LdCDxMJBMBBqfmSEELBIHFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358603, "uuid": "1af76e1f-fe3d-41fe-9991-d6d6d1ecb23e", "value": 7320691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358603, "uuid": "768160a6-5958-4c12-9d9d-11ef9b634c23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358603, "uuid": "aa5804c9-fc85-4edb-a817-63cfc2c4f515", "value": "ssh_brute", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6324a4a-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333164, "uuid": "b8995382-5275-4504-9f18-a15ce46547dd", "comment": "Malware payload (Mirai)", "value": "c1fcbf5b456b8a1539a91fe2fd42d460", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333164, "uuid": "dc5a8bd5-1647-4a63-a139-1797db0e1cb6", "comment": "Malware payload (Mirai)", "value": "b253914705ee609fca35a9bb69f318b7e871e14844f2dfcdc1ed7287d7bf6771", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333164, "uuid": "8b65d0c6-bd26-4a82-997d-5ef9f01ed13c", "comment": "Malware payload (Mirai)", "value": "716760e8cb9698be892ba62aac32dcc0903b11dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333164, "uuid": "28012d82-e3d9-42de-ad98-79e0c96c2d41", "comment": "Malware payload (Mirai)", "value": "e6f71c8e48ecc66baa829c87b58374b74eb143472b88c3b22c44035362e8ff8b8828d8ff694fa076bab8365dcc0f0491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333164, "uuid": "599231b8-bb94-421f-a2f0-2e0c243042e0", "value": "T15DD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333164, "uuid": "d69436de-85f0-458b-ab29-8eb7873b2b80", "value": "3072:79eSuygEPjt6qkWqxdKmDnYMb0gBd/gQyVGsdqml6Naj:79eSuygEPjt6qkWqKeH2laNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333164, "uuid": "bc1d248e-fff4-4856-b8b8-3ba7240427b0", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333164, "uuid": "78390a5f-f2d0-4e87-adf0-6dcdae70bc8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333164, "uuid": "45706a32-5ae4-4e87-9bf6-e707cb20e2d5", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70982136-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333020, "uuid": "2deca930-f851-4b70-8b72-13d54068221d", "comment": "Malware payload", "value": "0017987d6eece57935f48347350b4e88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333020, "uuid": "ad8d06c7-9e59-4f2e-a9a8-d861c116a6b2", "comment": "Malware payload", "value": "b3acea557bea869639f7849419f3e4c7d1a58e09a13faee4adcddd954d692c32", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333020, "uuid": "708c1d95-d66f-4473-baa9-a80850613207", "comment": "Malware payload", "value": "a3d763a522164e72e0ae4dc97d9191c6860cff69", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333020, "uuid": "6b098c08-0cae-4769-a36a-34d729db8ae2", "comment": "Malware payload", "value": "e6ff288fdb4aca3bbb071953ce958a90d281fbd47eeef92d1a17526d09bce2e3ced9382e6821b4dbd35a5ab5c29048dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333020, "uuid": "b05eed6d-d1d1-4ca3-adb6-499ebb581409", "value": "T15CA1ACF27808987161892E7478FB5C127667252FC212AE05B11776ED1C7BF99FF2C02A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333020, "uuid": "760e9a77-c237-4f25-835c-1ecd63e28e14", "value": "48:77VAQD0pDpVwEMjw5rub5NIZ5XQ5qsoAS99pI0Kn06wGG5EZfjiU:HOGjcubIzOoJ99ld6wGfYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333020, "uuid": "71f5d36b-6185-4d48-a11c-6a0d1ed750d3", "value": 4807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333020, "uuid": "6e5c1604-7a34-4a6f-9a43-e1cb953397d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333020, "uuid": "996e14b8-4019-43bb-846f-cdd2ab2c53f0", "value": "raw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0cec6a-8b5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785335564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335564, "uuid": "b26026db-303b-4956-b94a-27e6c4ef6929", "comment": "Malware payload (Mirai)", "value": "485112b73580f9fdef023a0dcffbcce3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335564, "uuid": "b2b2a032-1c7f-4d61-b460-c208b5afa47c", "comment": "Malware payload (Mirai)", "value": "b4215570e813bb63397f602d9243504a272af92dac0e5dad0ab62ef5958f0805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335564, "uuid": "4639be03-7a02-445a-8e55-7366ffd09403", "comment": "Malware payload (Mirai)", "value": "63429d79e798d8abd1c517e61d22bf69a5c7cf14", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335564, "uuid": "d54ed61b-82b7-408e-a718-1f362722490c", "comment": "Malware payload (Mirai)", "value": "e50691a9a8ac860b730958b2ef596ddda1b7c8fb7cea760c43d0db84e6f5119421346d2677e673471e91b6e92f63f89f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335564, "uuid": "3e622e4b-cd32-46af-948a-e3842a4eb848", "value": "T1CD13F1BDC6728A14EB1290743A713CC759A4A77DD9C0DA719EACF8364B83F95212E306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335564, "uuid": "f4cec465-3382-4844-85ec-b4564d5c5d06", "value": "768:kA1ztMM9BMhg74/HSbjyqY2u9SNfxqw3aa/FGUt5zgZJ+HvYq6cezk8GhnbcuyD0:lztX9SyaHSbGqYv99w3aaYUt5GY3n8Gf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335564, "uuid": "1ff34eaf-7dff-47e4-af76-aed5d945f894", "value": 42724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335564, "uuid": "a8a8c43c-653f-4ec6-818a-f4435bd91633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335564, "uuid": "c9d4b8f3-cebc-4888-9162-a1e73f2b7158", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7b6175-8b4c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785329556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785329556, "uuid": "e7cc7d2d-ab43-4ee8-9c31-e88b2ae00f3f", "comment": "Malware payload (Efimer)", "value": "0a7f48c4c09e3f9d552fc60dc4727fef", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785329556, "uuid": "f4a0afdd-628d-4cb0-8d10-1322127e6f4a", "comment": "Malware payload (Efimer)", "value": "b4f3acd50d0947aded733854216516d46990d57ce5e2cdcfdec432f0e498472a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785329556, "uuid": "67eb5592-9b0c-43b1-a158-1d592c4e4707", "comment": "Malware payload (Efimer)", "value": "115ce860ef3071481af5395668c3014e9349876d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785329556, "uuid": "26687652-1fa1-4715-ba7f-8874e00ff04e", "comment": "Malware payload (Efimer)", "value": "ec19bdf38b26a446bdb65c39b8e3674b8eec3ea15c168181557642f7c4a9345df42809d3eecec935434ec378c8d798dc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785329556, "uuid": "805f17a7-98b0-4c68-bbb6-17c71f267c78", "value": "T1DFE6332496E010EFDA63C47CEEE14497F5A6B4B50B71C68F6BE48AA05D473E08D3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785329556, "uuid": "7e986cb3-ba39-4e9c-9df3-e0b2185aced6", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785329556, "uuid": "ef452451-605d-4cec-bd93-b890246fca64", "value": "393216:PS4u6K/QbOk310ZXBLVOYXMCHWUjXHcuI3/PGTAI:PDOk3aJB1XMb8X8H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785329556, "uuid": "2bcc2e08-ca8c-4aba-bbe5-639766d8bef4", "value": 14325864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785329556, "uuid": "c55d44bc-de6c-40bb-9736-b5125ab73f12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785329556, "uuid": "243d26e6-763f-4822-8986-a8e33c65516c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1e2e4a-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333524, "uuid": "d84c56c1-d8ec-4c5e-a6bc-8ee4f8924581", "comment": "Malware payload (Mirai)", "value": "2ac07989def19371cb0236596b89bf9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333524, "uuid": "084dc8d5-9cb6-4925-a9bd-5302c6b342f7", "comment": "Malware payload (Mirai)", "value": "b6a5fad8301562cadab74015ece5957ea782810530997f051b498083b085a2cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333524, "uuid": "c320f24c-7685-44dd-a14e-59c834ac9467", "comment": "Malware payload (Mirai)", "value": "c162989ae3b3a2b207e5e372fa73018ca59bc3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333524, "uuid": "cdbae728-6431-468f-bb2f-48669ed9de7e", "comment": "Malware payload (Mirai)", "value": "584ffcd7f046c8fe3ebdd00e890517a3952b672769a95b2ca4e143fbcd86548e952c20363802a030b1ab62f48c54f2ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333524, "uuid": "dda01239-3104-4182-b4a0-76cd10d25f36", "value": "T12F044916F9C088FEC499D1784BAAF036E931F0AD527CB61727C4AE262E4DD615F3CA44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333524, "uuid": "1bfec84b-10b7-4576-a8b9-871a73876940", "value": "3072:+HwyKe4key0+zz4yc9VepuWtCWUohgpzM4r6JuwR+AYyMXX1:QwNe4key00INWNrMGJnWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333524, "uuid": "5a800890-baff-4f11-beaf-05d85d74ca31", "value": 180104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333524, "uuid": "c248502c-dfc2-44ac-b0fb-c96dea64be8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333524, "uuid": "6366c19b-9f63-445c-9637-81aa525d1b53", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2953d807-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321304, "uuid": "ac28dcdb-cb3b-4da3-8c5e-c0d6417a7ba3", "comment": "Malware payload (Stealc)", "value": "77857be5f099f715e7706217aae7dd42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321304, "uuid": "a14a749a-2686-4431-a2e4-5996e7e861db", "comment": "Malware payload (Stealc)", "value": "b6bc55d2b6e281b5bbf84f589a2847544233ad4b7abd05f942f27cba26703b8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321304, "uuid": "328c36c5-f5ae-4ae1-bd49-7d949afc21bc", "comment": "Malware payload (Stealc)", "value": "450ae818af5b4cddd0f832322013371c2e22eaf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321304, "uuid": "2e17153d-e284-4877-96be-cbe0dde3f3ca", "comment": "Malware payload (Stealc)", "value": "073b0eaec247a42ae2aefcd2f1db7eeed17a4d7ec023368aa5d2ffdd5593d622531fdc2b3905ae6d8cb1f9bd0a290e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321304, "uuid": "1c0ecdc4-6768-4195-9f48-de7be4d09b9d", "value": "T1B2F48E0AE3A541E8D0BBC1B4CA164452FB7378565330A6DF079946AA1F37BA07F3AF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321304, "uuid": "e9f13136-bc80-4e34-9c43-0aba231080ab", "value": "12288:2yu0W5kXYBKKn66H+9af6Gz613Gy8Fjyug8FrBNvsAHl:2y3DIBKKnt0q6K61WRFjyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321304, "uuid": "1b4b5434-2e4d-4bc5-86b8-cc2e89eea966", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321304, "uuid": "1e1acdbb-605f-476b-a02a-f3154f01c7bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321304, "uuid": "f9284ff2-df4c-4c1d-8d33-05fa821b94e5", "value": "b6bc55d2b6e281b5bbf84f589a2847544233ad4b7abd05f942f27cba26703b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673d3039-8ae8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785286619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286619, "uuid": "a24e513e-2ab1-404e-9343-00f86a66a5b3", "comment": "Malware payload (Mirai)", "value": "68f0d5f1d26379b7937b55d78d8bbc1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286619, "uuid": "c1eafef8-f4c0-46cb-8e72-bf272db926c1", "comment": "Malware payload (Mirai)", "value": "b8ba5580699a6e79742e679b4f8bc293fa903e31410a4a2bad0271731bb3c887", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286619, "uuid": "caabad7a-6425-49c4-b6f3-3934641aff1c", "comment": "Malware payload (Mirai)", "value": "ab8d7dfc80e3e08a6de971f21d6cd2476a4a9148", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286619, "uuid": "15c27e9b-a3b1-4ab5-8f67-6e5fe54a2d55", "comment": "Malware payload (Mirai)", "value": "38b91a97ef105ff5b2850dab55ce53708330ed5a0d10419815067c666c0fcc5268b68e07655c06a142e433fa5986c6ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286619, "uuid": "597255ef-56e0-4cbf-ad2d-84a68bcbe68b", "value": "T143E39DB3E4356E68C1628574B0348FB42B63A99992431FFB65B6C27410C7D9EFA1C3B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286619, "uuid": "e230b94a-2ed8-4536-b9de-9811a9dd7a64", "value": "1536:3aA0ggGZzqiH8NtJqC6EKp7cWDRz1eCWDeWp7+J07EEa10rb9EJ/2:3VgCeiH8Ntsrrpvz1eteWFn7EBr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286619, "uuid": "ab348c29-b1f1-40be-95a4-cfa68803878f", "value": 155652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286619, "uuid": "ab7fc9a6-1681-43de-82e1-93e1b23408eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286619, "uuid": "5e5f3233-7b34-4b2c-a802-ae1254007daa", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5d0363-8b0f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785303623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303623, "uuid": "190b2752-0e80-41c7-83ff-1f3036ba6b49", "comment": "Malware payload", "value": "93503c8aa9d816d170429b59c525cd91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303623, "uuid": "a44ac4d8-60df-4177-af1e-4587582d78d0", "comment": "Malware payload", "value": "b8d4428680a8b386e1fd9623e7a8d7e1b582534468226bb80d7a3335e0185698", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303623, "uuid": "e9ee2a2c-b189-4357-b88f-3d95024397e4", "comment": "Malware payload", "value": "69a23f00ba5d1ddf7a4a8ad800d4399c91bccdfc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303623, "uuid": "59a90534-f467-4736-9940-f28784d8f32d", "comment": "Malware payload", "value": "e78fbf7aee98734a9534c34df066e0ee3941b3e58f3d6c4cf7c98887ac1a253c6447a0d5bb83ff1f97ea35496abf649e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303623, "uuid": "dd3a4007-611a-4cb0-99b5-65d7b36cdfd7", "value": "T1FB35F23DCCA8453BC6B7D52DCB8B860AF84E8867371DED0A55D363D255262C2B8F212D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303623, "uuid": "c325c6e2-1424-4418-9422-0a4ba914b7fa", "value": "3072:HS1x4+X6kVUcDLDOQkxBL+u3KGnH2JL/CKJ8dHDMWp9KCsLTWWqMfuHbW6l4d2U5:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303623, "uuid": "328535c5-ad14-4fa5-85fc-376ea0a04c43", "value": 1122083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303623, "uuid": "7cf28f31-1638-4cc5-9b5c-34b949ae0b81", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303623, "uuid": "048b0c4a-ac1c-43fd-baa3-4ef3089ad76f", "value": "NewXPOXX#1439X.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5494e6-8b5f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785337981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337981, "uuid": "bc502406-7ace-480a-a3ba-e162a8dc28b5", "comment": "Malware payload (Phorpiex)", "value": "e5a7e8a76088d1cb0db01c805588bbf2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337981, "uuid": "3909da91-b5aa-4a0a-840f-f86cdacbbc54", "comment": "Malware payload (Phorpiex)", "value": "b91d0d56c1d7ed94962d0f6501761db3573b1090fac15d9424e8b3c8b1914c9a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337981, "uuid": "c019d224-c6dc-4352-bc42-f4cc5b9c3763", "comment": "Malware payload (Phorpiex)", "value": "f3b5f5661a7d7bd1661e6e6668b6790a659dad4a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337981, "uuid": "e51beefc-6e10-425e-b8bf-9be02c84c480", "comment": "Malware payload (Phorpiex)", "value": "14103f2cce3ee7c72f79910dc675ce952d218c45f05f749cc50bcc4c2896cf9c3ebb00265ed2cc230f060f6a0420961f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337981, "uuid": "c4a0f175-6a55-463e-b147-771588d99fca", "value": "T192621B0EAA818035EAD10076823F462745BD6C7223D4B9DBF7A068CA5EB47D1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337981, "uuid": "ebd9bb0a-b6b9-42b3-b942-9583214d08c5", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337981, "uuid": "a9f4fa92-ffb6-412e-89c3-176a623fe5f6", "value": "192:3X7wkiyXgzhDDAyxdq4lKQe33hg/FeaFResJKUSfTzwbkQaesmJxTmv8U9cthS9l:3Zi3DAybqFBg/Uf9TmkQzFav8U9ckl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785337981, "uuid": "ec7f7f58-7204-47f9-ac63-b6b681121aae", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785337981, "uuid": "aff60500-2e9a-44d9-a2ca-95f159dc566b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337981, "uuid": "e7db2212-22e5-4033-9097-fa4ec8b6a728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e51220-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333158, "uuid": "d442da5a-6855-4699-991c-a3f7530597e0", "comment": "Malware payload (Mirai)", "value": "303f821c5fc524b58f066618ae8af5c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333158, "uuid": "03a9471a-96a8-4999-8959-0cb2cf46c756", "comment": "Malware payload (Mirai)", "value": "b93eb36eb489daae00b021456b4f67b8841d4e61de387e6518bcd4a9b43661db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333158, "uuid": "ec52f9f6-7f65-468b-bab7-e70ff8c612cc", "comment": "Malware payload (Mirai)", "value": "711244e51cef3fc9874e4c596b01847d532381cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333158, "uuid": "17afde2b-27b2-4d2e-b2f8-e2947b2cc03b", "comment": "Malware payload (Mirai)", "value": "1c2b81fe2c6bee4b5cfbac97413a42718961e6eabe2acaa2e3f11a2a242d7c3f2822df66afc94bbb56f6a024987b2a99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333158, "uuid": "9c72ebc1-6fad-4cc0-933a-7215a51cd283", "value": "T1DE04881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333158, "uuid": "010f9415-549f-4a40-9878-970391f15c62", "value": "3072:jg57RE7LHZwbq1YSBan1yvbysxr1uGS/I:jglRE7LHZ0Bqyy1BS/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333158, "uuid": "38e9b422-205f-4423-9da3-da682b59aa1d", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333158, "uuid": "70656e35-f865-4144-8015-8dc03b6b8b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333158, "uuid": "722d12b0-3671-4751-a12e-a165ab8b8263", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7816d0-8b59-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785335404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335404, "uuid": "0c74cc8a-ddf7-4ffd-a1cf-1f70e43c4ecd", "comment": "Malware payload (ConnectWise)", "value": "c2972373fdc63127610f62f83b69767f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335404, "uuid": "cd4dca63-16b2-46f3-8aeb-a00b8b19b4f3", "comment": "Malware payload (ConnectWise)", "value": "b9b09102f0be935f39d742fe72bb0b98815d2a21b3f9b96c403ed1fb143a816c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335404, "uuid": "80789efa-c96a-4e93-89d1-7e3225f460ff", "comment": "Malware payload (ConnectWise)", "value": "84c997f12ab88b93800471b5b575049caad7b3ef", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335404, "uuid": "81f75356-d4d1-4f72-bbfb-fc9af89d9e1a", "comment": "Malware payload (ConnectWise)", "value": "88c57c64c439d951965dc2d170ed201153f94ceda06ca52e4334806163a762b0593a15d3b2ad5fc29edfefd9a91a7f7a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335404, "uuid": "4dbf9a1c-1ef3-4adb-bb01-391bdbfd2d86", "value": "T12846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC08E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335404, "uuid": "44506413-b369-4b1b-ac44-39c6ad715941", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335404, "uuid": "8b4ed633-29ec-4ffd-9f95-8a1bd452457f", "value": "98304:SzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:ShfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335404, "uuid": "2fd4203c-5abe-42dc-a855-edd495a78859", "value": 5641520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335404, "uuid": "b03cfc45-0f08-46bb-ad7f-ab5cefaa75a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335404, "uuid": "88e467a6-c9c9-4108-8fb1-bd2f72b14d7a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d015b906-8b22-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1785311706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311706, "uuid": "79c4c35d-722b-4d2d-b6db-11f76ea0ba23", "comment": "Malware payload (ValleyRAT)", "value": "4d69a7b084a2c4486a703e4c079079aa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311706, "uuid": "98fdb46c-2070-4cda-a6ab-5db1b27fb056", "comment": "Malware payload (ValleyRAT)", "value": "b9ddd7f8aaeb1247eaa881caf75f8749d4b7c4442408c37d9bb57ad9927ee19a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311706, "uuid": "88ca3940-3444-4d78-ad7d-91cf9fe7bf4a", "comment": "Malware payload (ValleyRAT)", "value": "0ea4745516c343e3e2f85b1c6d354046c7c25a79", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785311706, "uuid": "54ad7d0a-38cf-487d-bdc4-1260be77a51d", "comment": "Malware payload (ValleyRAT)", "value": "ed0a6f3be3360c37e61028ef3e4aa02050923e49377380837757e36e790eb4ae0b468511822788e39467ecd109fef307", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311706, "uuid": "66fa248a-9a9e-4224-b531-da8085bbcd5c", "value": "T10A446B5577A40CB9E9B7823CC9938606E7F2BC160760E7DF03A0466A9F2B7D0953E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311706, "uuid": "e43fc602-7e73-4dcd-b03f-a6e8fc40085c", "value": "1fd1f3e132919f622e30ad7a3ada4bdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311706, "uuid": "252f1c56-f4cd-4197-8fff-267a9375d122", "value": "3072:UY7JNH56UcFkfenaB0DBmAV6t81zetG3Inv7Tl48LWr9Ms8Yfk2ErRjV:59VzfenaB0Dkk6OhnfV8YGVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785311706, "uuid": "f89db023-68c8-4c20-ac84-96a059d583ab", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785311706, "uuid": "cc18caf6-880f-4a80-91da-f8ee253321b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785311706, "uuid": "dc17a09e-66ff-4ab2-96d1-0fe261461470", "value": "Notice%20from%20Tax%20Departmen.dmg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3beba20c-8b7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785349253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349253, "uuid": "8ad47be8-d488-4cc2-9108-2f340d046682", "comment": "Malware payload (SalatStealer)", "value": "db1cdbdc30d7056eecab4157714e8e43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349253, "uuid": "0d43d3c4-3eb2-43d5-89bc-b4bbfda1e64b", "comment": "Malware payload (SalatStealer)", "value": "bb24b382d5de5194bbb4cdf6d8127a3e82a205ccad251bcbc19100f876cd64d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349253, "uuid": "a1ddac8e-055f-417b-a9e1-f055f1f9953e", "comment": "Malware payload (SalatStealer)", "value": "9997e4c7b6cdcee95143e7b410992746f17162e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349253, "uuid": "5fc883db-7eca-4923-9cdc-3df696f1010a", "comment": "Malware payload (SalatStealer)", "value": "1091bd532984f24b112e86a0c8420e621d20d52de375c2b0782525dfacaf76eb54f7b09ac5f4dc6fec1b72851a1a5549", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349253, "uuid": "b2dba7a5-ff2a-4a84-b076-0e72de5c7c38", "value": "T10CC66C11FACB54F5E9035831406BB27F23315D048B28DBDBEB183B6AF87B6A1197A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349253, "uuid": "7d879223-597c-472a-8601-0e8315dd7889", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349253, "uuid": "89a67d0a-ee71-48c3-be0c-eb4c8572f6ac", "value": "98304:fUhSHKu1UL+2iy0NeDqgdnt4bc3HX+LElO/:ou1y0op5tDhlO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349253, "uuid": "6e2e0a0e-e814-4092-ba37-544ef9b1b517", "value": 12571648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349253, "uuid": "443d643d-1907-4f67-8935-fbae472c83ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349253, "uuid": "52de6420-edeb-491e-9585-17d907a9423f", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade04493-8b6a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785342572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342572, "uuid": "64ba90e0-c09e-4108-a62d-db1ecbab5fcb", "comment": "Malware payload (Mirai)", "value": "ce032b6372d15c53c367f0a66ae3851b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342572, "uuid": "cd7a8994-090f-4c6c-91c5-56544428ba88", "comment": "Malware payload (Mirai)", "value": "bb5a7c836e9a37aece882f9b04a3c20b2bfa338fdd29e41ed836a56f51f6a854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342572, "uuid": "e9f3fcfc-a44a-4eb0-882f-c5dabb58feaa", "comment": "Malware payload (Mirai)", "value": "45ffd6c070c3281a92b8df9dcc5bc43cf64250c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342572, "uuid": "ce783b3b-55bd-4e3c-8021-816a0ea03fa6", "comment": "Malware payload (Mirai)", "value": "aa149dbd21ef619cba0d91cac875e2176aa4180a5035be382311534de060eb5829f2c6fa16ca042311de111ce3ab78ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342572, "uuid": "93d5c420-ff59-4b7c-9da7-5e13eeb6934e", "value": "T157145AC3F801CDBEF80BF376484704097570779265935A3A73A779ABAC3A0D52927E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342572, "uuid": "fce06578-0d5c-4bdc-b560-c49b6637b28c", "value": "3072:XxtqC4F43sA2988LltiPlhNgEvJsAYV+jbisLy9mj2Vy67B/hfH:htqM3J8tiPlPg2sAnLwy61BH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785342572, "uuid": "37e45c01-e8c6-4930-9214-21801bdfee92", "value": 190528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785342572, "uuid": "f98f54a9-6b2e-405e-8e4f-39b70bd476ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342572, "uuid": "8a483726-dd2c-4450-ba62-2d5c2553d445", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86db83b-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307371, "uuid": "21341ad1-4943-42cf-a547-e6f5c48e33e9", "comment": "Malware payload", "value": "577a407ef21d1cb549b7546370cd7cfa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307371, "uuid": "d4a6956d-a137-4bae-8741-2e8f34b1839a", "comment": "Malware payload", "value": "bc589a05f21e9e407e856ae4306dae71699620844512694d89fded2d31ca2a20", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307371, "uuid": "8a3f24c3-1420-43ef-8150-3223c48a94eb", "comment": "Malware payload", "value": "40825b394f96175c82dc3744545524e16471376d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307371, "uuid": "9f9eabbc-71bf-4dc5-a17b-79afb62b3890", "comment": "Malware payload", "value": "7d21be3ef77857cbf4e2b8fa4c31311b65a75c20a93176d5a4afe395650cd1102544e4a4c59bc63e6004295dc87c48ca", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307371, "uuid": "10b46928-57de-4fe2-87b2-69ad5eec376b", "value": "T1B3F18E208F1941EFFB437CF085CA67863E429E797CE76605868459D442B9868733B25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307371, "uuid": "f2451c77-ce45-4f46-9c07-52a58a4523c4", "value": "192:Dq+gJx4z8olEWKT2vMD1ccke8mOFVOyUt:3gJCZlEWKTaMRLhOLOvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307371, "uuid": "dfe754c6-4401-45e8-9699-778b5104d145", "value": 7884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307371, "uuid": "f048bbbb-373e-4f7d-ac4b-c5f451704be1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307371, "uuid": "5a426c71-e35c-40a5-bfac-594d1443848e", "value": "images_20260728_064144.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed6c233-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354465, "uuid": "22481b9f-3dcf-413f-a2a7-d62db608811f", "comment": "Malware payload", "value": "5fe4d138aef4c2a91e0ccf17cac22abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354465, "uuid": "6584db10-cb1a-4759-99d6-3d0bb948984f", "comment": "Malware payload", "value": "bc9c4e81bc9acd2a93de62ba696009084594161da3db5eddc4774a006d8bd07e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354465, "uuid": "4e7dd185-45b1-4cdf-b0fb-ef32b142d6e5", "comment": "Malware payload", "value": "91ceedd5aa38c5e79e0facc25303a5178b305f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354465, "uuid": "5c27e161-9e43-4afc-bd25-a62fc1ad0b51", "comment": "Malware payload", "value": "ecae6b94a06a7c4bac21161d34c59acce79c9df8b2a21d978432ee67b3809a44b14b0b917607790b3d5966620477dbf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354465, "uuid": "3292c7fe-974c-49d8-8ec2-f3ecb6e0b2cb", "value": "T173F38E1BB3A510BBE1B79739C9630645F776B81147209BEF03A443662F237D19E3AB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354465, "uuid": "329b347d-f770-4e98-9f67-d9126165b6ac", "value": "5c9da646790c3ac480cd4ddda3f760f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354465, "uuid": "184d4d1f-4cab-4963-9b58-4c611c71fd7c", "value": "3072:UXXbVf4dfaWxXBsmquKeVfJGYz1CYvsZOM22bKR4:Uhwd5xXmchGYUZZ2ic4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354465, "uuid": "e9047ed9-ffd7-401f-8cff-4c21e6a3ed79", "value": 158208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354465, "uuid": "d06265ea-07bf-4c9c-9115-befe43ce3f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354465, "uuid": "72e6a19d-68c8-4f73-8b62-6ee4fc4cb0cc", "value": "bc9c4e81bc9acd2a93de62ba696009084594161da3db5eddc4774a006d8bd07e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f006e698-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307464, "uuid": "bb42e464-e273-4115-94d6-f8bd37a25adf", "comment": "Malware payload", "value": "e744ef98f58394f602529e59e2d69b60", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307464, "uuid": "a3a8fe70-925f-4d29-928f-9f9522b2999f", "comment": "Malware payload", "value": "bce37988e485df1ec7b6407528793c9e72e4a42122120c880113cba5b9fd6b70", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307464, "uuid": "6a6e60c4-5092-4f0f-9b5d-5e2dd05e8fc8", "comment": "Malware payload", "value": "c051a0c8d65296887fc1acd6b3a846ca64df66d0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307464, "uuid": "8bf27b44-51fe-457e-9573-24fdce93a882", "comment": "Malware payload", "value": "8ba5c899e2074463d0573aa837969a921af87fc885389463cd71205288586909a8164849a7d2d6b279a7148d3e1c02de", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307464, "uuid": "c68a9278-442e-4f8d-aea6-8903423da688", "value": "T170311D5943CF8C23D443F570B08177ED4EDC425587F9B206B919D4DD3CA6A5026DA11A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307464, "uuid": "5d84e0ac-363d-49f0-b869-ff64276450ea", "value": "48:9xTsPBWDk7J+mwsZYYwwEnMzaSO36yAUUtXuggMRT:4w7s6Yw1MY6Xtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307464, "uuid": "dcc7cac5-04d9-414b-9ccc-42138769e496", "value": 1759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307464, "uuid": "0f5ff7b6-40b5-43d6-92db-27ca16038c12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307464, "uuid": "3558e69b-7b1c-430d-b812-55ff7e02cb98", "value": "images_20260728_092855.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9044472a-8ba8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785369151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785369151, "uuid": "819cbb75-b44f-4d41-96f2-44bd4054489a", "comment": "Malware payload", "value": "1d9fe4ce4cbb66bba8eeec6046d1e2b8", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785369151, "uuid": "47ee3cd9-addc-4e25-a57a-7df88e4c0595", "comment": "Malware payload", "value": "bcf7bd7b46d57c055e8cde4588dae1aee094cc225074e0b5430640e90a8468ff", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785369151, "uuid": "33f9645d-1de4-41d0-99b0-ce2a43f9159f", "comment": "Malware payload", "value": "03000941571e8c6142feab0aa699476be4711157", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785369151, "uuid": "89d0924a-9be3-472e-a0ba-0c8d336b63c9", "comment": "Malware payload", "value": "e3d81e70a67c01833b7999411ed648cf91db4e0b82a01a024191c4913c404e7644ff1aa947582b382f2b100195b86a5b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785369151, "uuid": "1631b322-c612-4861-88d8-4874870aa0d2", "value": "T140E6330485C002FED963523A9DE1E5A6E47AB87443B3C6DF8BB056367EA32E04E3D517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785369151, "uuid": "d17f7733-c5cd-434a-bd8c-bd471a82ff9b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785369151, "uuid": "9162a228-e2eb-4370-bfe9-5a7006a668ac", "value": "393216:XgsueBHG4dwmMpS+fbOXMCHWUjXKcuI3/PGTAI:XgCBLdcJ6XMb8XnH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785369151, "uuid": "8e01f461-bb39-498e-9557-dd6fac860b1a", "value": 14295300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785369151, "uuid": "fc1518c7-d519-4b88-8e69-a50b6b0b10a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785369151, "uuid": "ac9ac559-4095-4281-8bb5-466c3381d9f1", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a594d927-8b8c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785357161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357161, "uuid": "dcbdc14a-3d9c-436d-aa58-4386191f0dd4", "comment": "Malware payload (Mirai)", "value": "8c21376ca7a9fdb38c4a9cc2ae62cbc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357161, "uuid": "52a91ffc-15e0-432a-9d47-847204f8dfc8", "comment": "Malware payload (Mirai)", "value": "bd744729e85f0084857466fe1d3df9d5caacb8b1f7cb0ac2bac6067361907da9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357161, "uuid": "8d622f86-5521-417d-842f-007e39de83e9", "comment": "Malware payload (Mirai)", "value": "479358d113de7a6f1d52147b65dcc5d58b52d9d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785357161, "uuid": "5c60da32-0b44-45ef-a966-e965de36dfc6", "comment": "Malware payload (Mirai)", "value": "dab40b9872e46c2a8bc4750b7e50de0a3bce85f298477332be735d414948fdfa2c353ae3ee1803ec33c4b0f21fc07eac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357161, "uuid": "5c845285-680e-49f4-9b6a-9b2fa4f96c89", "value": "T11CA3C84AAF611DBBD81BDD3705AD0B4235CCA60771683B723934D928FA4A54F8AD3CB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357161, "uuid": "cd9a8546-acb3-420d-90ae-d25603c3446d", "value": "1536:TWAuojFRU1tftXcTBiA60g34SF83a6H5OQSJX4mMU4py70D5HPE9Sp:CAlqtftXciA6n83Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785357161, "uuid": "3a737d1a-46ba-40b5-ae72-411e16f41da2", "value": 98444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785357161, "uuid": "645e6c66-7829-4429-a02b-429d24f2d1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785357161, "uuid": "0004312c-1b87-4335-ad59-3d6656520046", "value": "RYb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fec6552-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785327355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327355, "uuid": "275ba441-f831-4079-827c-3fa8b89bd7a7", "comment": "Malware payload (VIPKeylogger)", "value": "a7e7c0a98f8e5dca6f1c15b5956294a6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327355, "uuid": "e5f8b937-ddb7-4c87-bbdb-cb564d615fe3", "comment": "Malware payload (VIPKeylogger)", "value": "beed089163efdba28ff4e0792272c79708c3b471be85f39bc1b5b8be2ff479cd", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327355, "uuid": "9a916ac9-ee2d-4290-906b-e166382274e8", "comment": "Malware payload (VIPKeylogger)", "value": "923f08913c8c05b32c4f89e3395b714a677d4bb7", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327355, "uuid": "ae46ed70-d0e4-4f13-8b2a-24e087fc0e4d", "comment": "Malware payload (VIPKeylogger)", "value": "bd24fea599c0eed371b04e07eb2b19249b3d00fe5a882cbe508a418bbe0b3fcd797704b58fd7a63429bcfb6955e33a78", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327355, "uuid": "9908078a-be04-4ae8-b32e-03bd0746a9be", "value": "T16E351312EBE0D49AD4590533CD7263F3CAA9BD61D3640A87778C7E487F723429A1B381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327355, "uuid": "fcd3e174-6506-49b7-84e6-a7e8e4ed44a0", "value": "12288:AfYPo/gfgMUCPvcU8bLqd3sqItJSfgpf6DtdzfW9:AfYPo/cgIH/8/qdGTpat9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327355, "uuid": "6e7e49a4-4abe-407e-8e93-67c509bbc944", "value": 1138688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327355, "uuid": "be6c5a94-79a8-4da1-9acc-62b8b574a111", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327355, "uuid": "a049f845-7382-40bf-8704-0eb1d1664d46", "value": "SWIFT07282026.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64373a3c-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354474, "uuid": "e2c1d776-6c0f-475e-a008-46f62b5edc18", "comment": "Malware payload", "value": "c79eae94b61b603d34ac50fadd2755aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354474, "uuid": "74249a0d-931c-4347-b177-0c832ac7c042", "comment": "Malware payload", "value": "bf38ae8c1b495b2a547337759969967a8bf632f5adbbd9a9bb7c724007d684b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354474, "uuid": "20f5ebb0-9b2c-45ed-923e-5bc7401d84c1", "comment": "Malware payload", "value": "807b6700644854b9b4f84c21dac86b384b50c2ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354474, "uuid": "53a67d25-c90b-412d-8a3b-1122ad0576ef", "comment": "Malware payload", "value": "6fafca927cf0f8a0314a3a0720fc6ef0bc51c54dd0a40ab1b4922f98d9e0823a21cd788b6476971e5bdb97b64166a0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354474, "uuid": "c4437b3a-cf50-489c-8980-609705c70aad", "value": "T1C9749EA5BB5F4463FDE58035405288CCB37964ED89017AAE8AC6721E0D17EE40EFAF74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354474, "uuid": "c71b7698-f908-4f47-9a7d-5286a823a5ee", "value": "bf949854a0fc6d2bcf5bacdd08688a0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354474, "uuid": "52dbf78d-8f68-4149-a4ff-6a08c6bc6714", "value": "6144:KWpPOSAUwgQesDdDtHLQUt/K6UCknPhcgrrdEmhxKZqdjmDTI:jlOgQesxVQUtC6+n5cJmhx92T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354474, "uuid": "aa8e5907-dbff-46bf-a041-9bfabaf1a456", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354474, "uuid": "3ec79202-353c-4deb-8f3b-1139afa3bf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354474, "uuid": "af4a2d61-fa0d-44de-ad5d-2756fbe9210c", "value": "bf38ae8c1b495b2a547337759969967a8bf632f5adbbd9a9bb7c724007d684b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdd998e-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333019, "uuid": "003cdfce-6da1-44bb-ac42-486d4463ad06", "comment": "Malware payload", "value": "1d7f4dc3bb0f1c1402bded5c627cf3cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333019, "uuid": "44daa35d-bad7-44dd-990c-1ca21f28b467", "comment": "Malware payload", "value": "bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333019, "uuid": "23293af6-fcd8-46c0-8e1a-72faf0df0bad", "comment": "Malware payload", "value": "fdf7f6c3ff116b1076564fc498475ba91d1c82f7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333019, "uuid": "601727d4-f83f-4c12-8818-da94c7fe3d9e", "comment": "Malware payload", "value": "701f1604c2bb5d4320990119cdff47e31e16455809d44bbaeb57ec665b93f3103072fee3768d3dc8553b01f0a9fbf015", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333019, "uuid": "2b1572d9-acff-45be-ae6a-d586a293371a", "value": "T1162121D6B0207E70298FD92820FE281C7282112F2F9D6D6CB0CB446576FC586787CE2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333019, "uuid": "3084ca5e-d552-4f78-806a-3806d79a6ef8", "value": "24:j4ZCXI575ZkRhyLjb29bCCwm2VOkNbC35QYGkpGh1r2cnO3:ji752RwTM1KZNbO5QYbp41H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333019, "uuid": "2ae0c1ef-19da-4332-b532-3158de93cf03", "value": 1172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333019, "uuid": "41181296-d042-4a39-9261-95655f30f241", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333019, "uuid": "7d23a397-84be-4113-b4e2-a2379ab35cc0", "value": "888.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dfb38b-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324411, "uuid": "420aaa6b-d437-4292-9242-ec4dc344658f", "comment": "Malware payload", "value": "d2ae64f1b9256e41579d3cfd39de31f3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324411, "uuid": "840e77e3-a067-4bfc-9455-8ed38f55dee2", "comment": "Malware payload", "value": "bfba0f68e3d05e85c69a1522a0dac24b9e5e1369675e7ef93ed840f97120ac1a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324411, "uuid": "b9dd87b1-c0e4-4787-8cd8-abb4e3210d09", "comment": "Malware payload", "value": "904c8e6fd53bdb6a7775edf00a993ae5c8a3ce3a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324411, "uuid": "e160c144-f8b2-495c-ab62-ff1a7e2b9b59", "comment": "Malware payload", "value": "ea2e52f3cf02d516f5c9f9a88a8fee4a2b05c8ec6a65fbebbc14d67af9030329fa7d39d9a8a07188737396203982d7a8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324411, "uuid": "97e30218-3efb-49d2-bce6-b564518c3954", "value": "T1B821C5E8A59443A5CC172171FE53ED0C322569EB190FD9B3273204B628EAFEF67E1804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324411, "uuid": "afd0e192-d4c6-4e63-a3eb-bdc8a396938c", "value": "24:9NCNp5ONY4jyRkkLe2MjZNw4AqpsF6O9+1Kslwommk84UYA4P/OINoIjFTZ4LX:9clOS4jrmX4ZNPsF6s+1KCwTT8jY3ZoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324411, "uuid": "0f98e51d-bcf5-4412-91ea-843f03d51975", "value": 1379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324411, "uuid": "6598b18c-4834-4f19-b781-2ee5fc7a112a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324411, "uuid": "c2a8289e-d5f2-46fe-a27c-fd4218e4d9d2", "value": "photov_773221035263.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0133a25-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352562, "uuid": "adbbab44-ff68-4c98-b4f1-580093eb10a7", "comment": "Malware payload (Mirai)", "value": "d7edd0caae42aa2de506798b06fb62ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352562, "uuid": "e718ee5f-0c4a-4828-a676-57d1045b26a7", "comment": "Malware payload (Mirai)", "value": "bfc864e08da7597e73bc116169c20acab325ac0ed4efcfde5cbe751f7334416f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352562, "uuid": "c0ec3a7c-f8f8-459b-a436-aaa8e42ed069", "comment": "Malware payload (Mirai)", "value": "96a4931f518314777719745ba32003b8212d4f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352562, "uuid": "f10b363e-65d2-4e40-bba0-64c96501c6a8", "comment": "Malware payload (Mirai)", "value": "898bd5a4228d6f27dbd60a58c3a122d825dbc6169001d401592a8e2dc48bcb15b0807f9d28da90b5194be3e93c4989fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352562, "uuid": "fdd512a0-bea4-4b6c-b258-ff789a816eea", "value": "T11DF33B01735C0447E3A75EF0393F6BE597EFDAA021F4A245290F978A4171E32698AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352562, "uuid": "ac103aa4-c2c5-45a4-ad17-52e21e7d90bb", "value": "1536:c7B6HoZls8+6xGdUNn89A5w4xRRAbj9upuvAsHnkm1+fdGp/q6yQ0HprwC+rW8Bp:c7x+6xuUNnc4xGudsZsHh6W8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352562, "uuid": "d8b76c61-f0e1-4ead-9d89-23a91f25b9a9", "value": 168376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352562, "uuid": "4a3e7ac8-5121-413c-a161-9043faf2a52e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352562, "uuid": "d8f022e1-709a-4862-b4b0-079396e5707d", "value": "zero.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2a7ce4-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349765, "uuid": "04467811-ebec-478c-8caf-a69a88984e23", "comment": "Malware payload (Mirai)", "value": "5241cc22d4041a5f00d3fc0a9d7b4c4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349765, "uuid": "15570b68-20b7-4bc6-870a-bd1e1249605a", "comment": "Malware payload (Mirai)", "value": "c02d13068650616ee7d93748d98a79e942dada09016ec5a18c725921dbbecf3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349765, "uuid": "0d4f272c-05c6-4383-8e64-8d9cb9516b80", "comment": "Malware payload (Mirai)", "value": "7de70c007e9a849e4f07fe3a93402437cfdcb0da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349765, "uuid": "9e21d3ea-8b89-4886-af41-73ded3fffe1e", "comment": "Malware payload (Mirai)", "value": "bd158041defb5e04ff8de787be7d35c03f720cf003d841beb107945cf6234393a7351c3754eed6568cfbb15c440a5cb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349765, "uuid": "a108b369-fe8b-49ae-b88a-aa5310a12607", "value": "T12E83021785BECC61E4818B33F5D2C9B53BA4C29731DBEA1364ECA11D486F69D472486C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349765, "uuid": "e41d3322-b03b-47e2-a432-2c34a930a755", "value": "1536:2MQTJKU8xv1gXe+pngX1wY9ccwSo4GG3KOuMvYL2/eUY3c+XX9ErZprT0oO:VQsvhQngX19GLSeG3KOuMvPU3c+XtEri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349765, "uuid": "11ccb802-2e8d-4c61-a5ef-5a42a01bac06", "value": 87020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349765, "uuid": "91a2b9af-7e21-4d18-8989-afc1d528bf80", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349765, "uuid": "322a3143-f29c-47fa-a6a6-d015c799c4e4", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de15affe-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307434, "uuid": "5e50c9f2-b40b-4056-afd8-3430fd00e997", "comment": "Malware payload", "value": "2741144605158b41ba1981c43dd318c2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307434, "uuid": "7dc5dbac-b418-4d09-99b9-b6005ba6aed2", "comment": "Malware payload", "value": "c048a593b64283dcded4ad7b0ca69e8510c2f969576c40e04058dc949089ce9b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307434, "uuid": "c5c86e61-080c-49a3-afe8-17e7098185fb", "comment": "Malware payload", "value": "ecc45418d5c39277531082b2cf641313863f70da", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307434, "uuid": "187f40da-9175-454c-be5c-f4408d23d9b8", "comment": "Malware payload", "value": "082a6ee1db439456a6be9803fb361f0c856267413a0e4b20254c53a94e22fa221292fb6c88128519ea6271597d8f88e2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307434, "uuid": "b0b64877-b807-4d4d-9ff7-2fc0db41db45", "value": "T104917D8F6E1F2123DCA765B4ED4F4F65875065C15BBD820A3C27C1D8883E5A22A4A34B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307434, "uuid": "7de4c80e-e6d5-459b-bd63-9a10c9b4f876", "value": "96:dTEHoYoInBTz6vgvK00US04kxD0+phIy8307IcezOMKhltH+6:d4gIwvgvK00US03xD0xTydSOJ+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307434, "uuid": "6f903cf1-cf35-48e3-807c-4d10213894fb", "value": 4447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307434, "uuid": "24ad982e-898a-454d-b88c-382e88dc53b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307434, "uuid": "7c59caf8-5411-4bc4-b738-253a5531203c", "value": "images_20260728_202434.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae00b605-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307353, "uuid": "f6c92c3d-0c47-4928-adc5-2a716753458f", "comment": "Malware payload", "value": "75910cd0b31628f3215fe5b6791c8884", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307353, "uuid": "2dec6527-6d35-4819-b2d0-569b6380a3b8", "comment": "Malware payload", "value": "c04e55ba5d5634452600a9c7efe9a9c239d2f1cc162a22b543a0f64c10e36739", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307353, "uuid": "8d56dfa6-d328-4b82-a69d-d90a792b0084", "comment": "Malware payload", "value": "ba8bde7a16c2f193958b710cf18227c4dd0fa3ca", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307353, "uuid": "710c3b03-4336-442d-8dc3-2c46c1cbe54f", "comment": "Malware payload", "value": "0e9f1200bb4fdd443643ec3ee2122e782045a0df16fd4218edfa58356d294118ea62b449a2f686a92d0e0fb64fb02f40", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307353, "uuid": "a5925e93-34f0-4171-b2b3-3dbcda36584a", "value": "T17902BFCDF0456C2CEBA7DA7E3A880C6EF02D0DFB8285A5019D4E96F810166F64BCA511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307353, "uuid": "8bfad7c3-5b6b-4344-a4cb-9c295df9d108", "value": "192:Z37m9rZPkCSSXtJJt4paDvWRvxqqTPPCdKTgha9suXw:E5UMD+RvxqwidhMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307353, "uuid": "24868ffd-f126-4596-bc6b-201550c02fe0", "value": 8675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307353, "uuid": "59cb0dde-a811-4fde-b753-31ca978eba3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307353, "uuid": "c0d62137-1c7d-4843-848e-3051ddf73467", "value": "images_20260729_030132.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39ec16a2-8b9c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785363852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785363852, "uuid": "0e0c5884-c5dc-47fb-bbcc-49eb19438f5a", "comment": "Malware payload", "value": "6fbdd4d76446e81cee9cdef60d64aff2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785363852, "uuid": "d205c660-4978-4f1b-ac5d-c8f487ffd48a", "comment": "Malware payload", "value": "c0523063abe84c4064e3fad4f5503f9a7ea500420ddf909ef4ae1979da45cc15", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785363852, "uuid": "fe77ee41-bcf1-4139-94dd-6e4059e340f0", "comment": "Malware payload", "value": "7c7bd51937146a14b3c63d4165ff10fbaa3473bc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785363852, "uuid": "9394e2e6-44a9-4264-9c65-2d3e948e1874", "comment": "Malware payload", "value": "5f230cccd79d30c8893223936ab94fc2e39bf9ab4e583fa2181fc1e4c6846e50a96ec4b5c5e1866ebebe28a2b65bddd1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785363852, "uuid": "607ce255-6a8d-4acd-bb2c-3d3604c1909b", "value": "T16AE026A2B44280324A889447C55AC4A9709234032C55B22CA0337A718F8D168E23AFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785363852, "uuid": "aea3e3a1-88a7-4781-acb5-9c6b27982983", "value": "6:hZ+lfUzB+QFnTAJ3lqLeBsASA9QafpbA9Qe5plVyQJfRX50:SRpQFn8J3lfYA9QafpbA9QgpT1tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785363852, "uuid": "732bcd78-16ae-4dbc-8028-08cf0745fe39", "value": 322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785363852, "uuid": "e6da6efa-0070-40bd-8f31-74f07eecd535", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785363852, "uuid": "36e95db5-35e3-4884-bd39-c0c473e92105", "value": "c0523063abe84c4064e3fad4f5503f9a7ea500420ddf909ef4ae1979da45cc15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a40cb0c-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327372, "uuid": "beda0e05-3fac-4b41-9289-a9921f059e08", "comment": "Malware payload", "value": "62f16aee6d60fee3e0d62e56473b4d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327372, "uuid": "da6f39f4-a49c-4abe-b820-431977cd3850", "comment": "Malware payload", "value": "c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327372, "uuid": "167495d5-2c59-436e-bbe5-fcce25a087f7", "comment": "Malware payload", "value": "4ddd39fd0283fad558d63c9d540b644141a7c0a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327372, "uuid": "655db030-ae73-4661-8e04-db35416cad6e", "comment": "Malware payload", "value": "d4b5a45d367dabb1435c08e0232d2bea4118ee57e99ea47b6e440316f32ce1ecab03ff1aab117546eb608eb26f97565a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327372, "uuid": "4a4b4585-35db-4584-ac22-ac54cfb5aa80", "value": "T10574AE0191A80A99E1B682F8C43305468F7DFD49CB60C95B2AA542FD9F37FF5503ABE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327372, "uuid": "164e44fc-798a-4295-9f2d-8f9e313d0e94", "value": "cc17bcc7fe575a59b90e88841fe76dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327372, "uuid": "a59b194e-a09c-4e17-bfdf-38a3e70d844c", "value": "6144:Gq/8TB/sK0skAAKEEiPzzmgPBSi1sJHp4V9BKapTGDG+u9HJ9i:H/rKmEiPPNB5kewgGDG+u9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327372, "uuid": "4e4609ab-db5f-4405-be6d-a15c9b0ed461", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327372, "uuid": "95acc3e7-5ab7-40f1-84c1-c4ddde4f0c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327372, "uuid": "478701d3-9ab5-456f-bdbb-24da2f370513", "value": "c0daec5c4417c16de8bced454b51cc02c0ee57ff66257b9516d6ae69ecf539ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7251e996-8b69-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785342043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342043, "uuid": "e04255e8-caf1-412b-a9e6-9eea270a0bd6", "comment": "Malware payload (Mirai)", "value": "129932e20d71fb3089cda7fbd5e81b9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342043, "uuid": "1a5b9adc-72dc-494a-89d8-f984c43e1065", "comment": "Malware payload (Mirai)", "value": "c11fd6a7eb8c9c12b53c1f073101ac691d56b40188a60daf44eed58b70b31cb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342043, "uuid": "54f28504-dd83-4d5d-a197-cf969e0d377a", "comment": "Malware payload (Mirai)", "value": "0701d1f8bd3fc78f93e48d21e34235cf90236b80", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785342043, "uuid": "fa3975f7-3aa1-4ba3-8437-e845d565e00e", "comment": "Malware payload (Mirai)", "value": "9271d1323c46a476adcc6fe897d522c88458ddf0412db5b9e5b094caf0e3e665a347957a7b0bad76870ebcdeec8a4932", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342043, "uuid": "391492f1-7460-4b62-8b45-daef33428051", "value": "T15324B85E7E238F7DF67887344BB35E20A65933C523E0D584E1ACD2505E6028E646FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342043, "uuid": "7cd5bddb-db4a-44cd-8f82-875e501ac014", "value": "3072:255IJGxD0TCbinfLsN7x9ytKu6JnxLX9JM2MhOW67m1Hw:u5IQiCb+fLsN7MknJNe2MQW67m1Hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785342043, "uuid": "d9c2e24c-bce7-4690-8207-2c60c967bf79", "value": 218384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785342043, "uuid": "5e2b7881-7c06-4a7a-9700-3310679875a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785342043, "uuid": "6791d0c5-89be-43a6-884c-b73a7d2cac70", "value": "zero.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d911ce5c-8b37-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320740, "uuid": "e5d588a0-b807-427a-83e0-11fdf0125e91", "comment": "Malware payload (Stealc)", "value": "6c31dfcd522d65460e749941d675c714", "object_relation": "md5", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320740, "uuid": "b1a32b3c-368c-4e09-8b9e-7da2a374b7ab", "comment": "Malware payload (Stealc)", "value": "c200f2497e8169897a1f0569e720331faf5f2fbc50530614641d612b4488797c", "object_relation": "sha256", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320740, "uuid": "410a100e-e765-4a6e-af35-83db13c8b4a8", "comment": "Malware payload (Stealc)", "value": "050d1fa390f009dbe1263b20467e3714d0340506", "object_relation": "sha1", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320740, "uuid": "5a3f251d-4e7c-42fd-ae05-f702d4225700", "comment": "Malware payload (Stealc)", "value": "3a76f2a800d3525823d293b7f3500b9b4558ed07b6e68a3c3e55830ba8dfdf14ff40d7200f6ab17ea0ba1129105be040", "object_relation": "sha3-384", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320740, "uuid": "df642c53-9581-4b36-bf24-6fb68a37e47c", "value": "T1E6058D1AE7A542E8D0BBC275CA124452FB7378525330A65F079946AA0F37BA07F3EF11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320740, "uuid": "3ab52248-bf1f-4067-bf21-2137baacfc44", "value": "12288:EyxlWjpe4gaqxnbkXOOmMFQIqc0xjyo0ZbcTaZ:jOjgaqxb2OOb6Iqc0VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320740, "uuid": "face0d5a-fbd2-4d36-9334-71431b1cb09a", "value": 817293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320740, "uuid": "746e3c8b-268c-4ae9-a6d8-75f21bdc9daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320740, "uuid": "7ed967ed-dcd0-4e37-a3a5-3a5f99ae95b6", "value": "c200f2497e8169897a1f0569e720331faf5f2fbc50530614641d612b4488797c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b47f30a-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785351775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351775, "uuid": "cc38f57f-45f1-4113-adc8-9e931ce4a53b", "comment": "Malware payload", "value": "5ec294100e7b09b44c1f941784e0d133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351775, "uuid": "c2b8c6a5-63b8-4aa0-92bf-81a918656204", "comment": "Malware payload", "value": "c297678aeeca8dc51d1c9ba9b70505210dd8f43199daa00d4995e0a923336762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351775, "uuid": "64de1322-b932-4d0c-a545-9c1babfd0034", "comment": "Malware payload", "value": "d9430d82e9e68ddfeb61a5bddf5fe69a8bb33bcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351775, "uuid": "b6b860a7-f0bc-4593-b34d-edf8b12ea3aa", "comment": "Malware payload", "value": "dc33a1a6cfb7e7d5814040e57714479150bdba97894fa7bccf3233c3c483ace4a5267f4fe77696af59849365fb0b0032", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351775, "uuid": "d44d8cf1-e685-4c29-90fc-d7ee65e97939", "value": "T1BD14D81A9F510EFBDCAFDD3702E90A0635CCA54722A43B353674D528F54BA4B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351775, "uuid": "44016192-7df9-4020-bad4-3679e3c233f3", "value": "3072:MijlUx4cPEJVC9qPLpAUBKKHkkDxCCtr9kNrS:MylUNPS0qPOKKKh1DrGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351775, "uuid": "85fbc35d-3d26-4e75-ba88-6b2c0822ee92", "value": 190936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351775, "uuid": "2c299fad-ed48-4f8d-995b-73e4d6f8fd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351775, "uuid": "a2355d21-ae1c-4228-82ff-7cb15180bb8d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a5d990-8b17-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785306861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306861, "uuid": "6df5296a-6184-43cd-a157-bbb1edde606b", "comment": "Malware payload", "value": "f49a6e3a830b1af275676e8c29a6628f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306861, "uuid": "b92e7edc-bf0a-49ef-ad7d-5a9921d35c56", "comment": "Malware payload", "value": "c493897441710535756b48ee71c1a485df44182fd65bf09455f7fff0d8bbdeba", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306861, "uuid": "cb3edd26-abbc-43e8-959e-13c555a4fcb2", "comment": "Malware payload", "value": "5d2b31194eb73a14796a5089af4834974a5f40a9", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306861, "uuid": "6b1399c2-1f23-4b13-abe3-da86492ef5a9", "comment": "Malware payload", "value": "378c42a28dbcc5b1c7dab626ad196266e58c9f1ae74800945e82ae2ab45197abac0dd014f53dad14c9b212b37acf2066", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306861, "uuid": "ba49f758-27f2-4ed4-8b50-d6b8c61b572d", "value": "T13732099CFEE162B0F31743DE37AB2C2A122461972008C5C1F94DADE47F467D88663A5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306861, "uuid": "25e52184-457f-418e-b6e7-ea22e685af95", "value": "192:sXHNsGeTHQpD+da6+888+UV7tDoj/pxzi5JYb5QqG5HdXIZd4XthOO:sXX+/DV7k/3i5WaqCXQ4XTOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306861, "uuid": "ec523021-b292-44c7-aea9-181255551cbf", "value": 11821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306861, "uuid": "27dc83de-7053-4748-abb3-ac0988be5096", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306861, "uuid": "adb666e7-2697-464f-bca6-a9e1dc895411", "value": "okbro.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dda59d-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307293, "uuid": "5e451cdc-5f43-406b-96e1-363b3bb3ae69", "comment": "Malware payload", "value": "4472019402f423372b9fd27323691eb9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307293, "uuid": "61e6294f-7e33-42f3-b8ff-6167717b401e", "comment": "Malware payload", "value": "c4b5e27653d3183f4c335f17aba89b1daf6cd18ef498cc70b2ce8e8b5c29c1ff", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307293, "uuid": "b57e500a-e55c-4dd5-869f-fcdbe732a76b", "comment": "Malware payload", "value": "bfe28376998e1e4a12b76a743bc4d21b663f8b00", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307293, "uuid": "645e98b4-f5a1-4a79-bfe1-8541fbbbed3b", "comment": "Malware payload", "value": "e0b17bee96f5ca96773a818af7483da8fc13d7bd962eb3f874976170f9cc3db2ba4a36786c53aeb7b63354c5f3ed2b69", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307293, "uuid": "797e89ed-12e4-4007-87b6-05589a108e61", "value": "T1A952C007EDC618D9D68A76A0DD53EA02E735AE3B48CB733273F06142F8A859B5B17044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307293, "uuid": "b0e93344-fe03-4450-9f82-e86a3edc184b", "value": "384:FohFNkx2sovrhhRI4G4MkMCTg007iX3vsQsoLaDtSfw6k:ShF+avruDkMAg00+HzLgtSfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307293, "uuid": "d2f1aabc-cd04-49e7-97b9-544812d3a569", "value": 14385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307293, "uuid": "d8e07865-4aff-443c-aa52-d348671db2ee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307293, "uuid": "6e3dc2f0-37aa-4672-b970-3b4d074bab21", "value": "images_20260728_090756.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0811a6ee-8ae4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785284741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284741, "uuid": "0e95830c-354c-4142-b057-d9e965844eb3", "comment": "Malware payload (Mirai)", "value": "924e0875019486184fc6de7c9b94a186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284741, "uuid": "eea4a72d-9717-4a6a-9a95-1cbbbfd8f40b", "comment": "Malware payload (Mirai)", "value": "c4e659790c6a66c5ffc8a091edc4ea823258a6c684d8e50d147371e88d8b5775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284741, "uuid": "0899f4f1-7c7e-4a88-8b57-86299a14496f", "comment": "Malware payload (Mirai)", "value": "9d1998de836e414d53e8bd59800ed900b2839e9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284741, "uuid": "87bbc810-3ed5-41c7-bb41-94c518a1603c", "comment": "Malware payload (Mirai)", "value": "a774a3c3d7ac628b7ed96edffe848fad6094a39b8fcb73ca63c56920ba2f81f5e3c2f3e1c3fb5ecacd32ad929882eb78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284741, "uuid": "4ea3390a-a1f4-425f-978d-c8052c5bcd3f", "value": "T1C3631985FC825B1AC2C117BAA5BE668D3320A3F4D3CE3127DD224B213BC951F5936E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284741, "uuid": "e9138d6b-5f72-43c2-8d0f-e877ba25190e", "value": "1536:z5V+/ftpZtPZRmF5YiDQR+jKplQJa10rb9EJ:zX+n3LWfkmC24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785284741, "uuid": "0191d9e0-cf95-40d2-b4e9-426fcd856b09", "value": 72760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785284741, "uuid": "ff5cba31-99c5-403f-8726-c05fc4a58c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284741, "uuid": "1b0aab1c-3d3f-45d4-81fc-4844e82fca50", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee949458-8b81-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352559, "uuid": "781bb368-96f6-4122-9ccf-69a0e4dd3373", "comment": "Malware payload (Mirai)", "value": "43d8804a4fd0a221fb0c222e332426fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352559, "uuid": "b788857c-2119-457d-b85f-1680f06e4a87", "comment": "Malware payload (Mirai)", "value": "c51cd6ef8dda0858ddcc67d4742b2ec0f9a3889d1ac3a3c7627f443e4ca68a79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352559, "uuid": "23b503dc-53cc-400f-879a-2917b1a0e703", "comment": "Malware payload (Mirai)", "value": "cd15d495998a72e7519ef2ca4b372eca0d601a2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352559, "uuid": "bc285a0a-53a5-4543-958e-0f24d2b6f4b3", "comment": "Malware payload (Mirai)", "value": "8e7bd9c6354f5a173f612dc76d43772272423f977ce38c0ad554382bad1384e8c1da88934ab8d077397833d6f994a6c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352559, "uuid": "ebc20ade-2457-4ab9-9928-cdc7cfe689dd", "value": "T1F5C32AA9F880DE62C6D5267AFB4E418C33231778D3DE7105CE149E3467EB95A0E3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352559, "uuid": "ea5466ab-5ef5-486c-bae1-56a9c305c3bd", "value": "3072:CON9L2wOtnosmfncYEEU0084WnCwlDBteiMALe++pH5aA1Dz:COTAmvcYEEU0HnphBteipWZamn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352559, "uuid": "a430c7f6-b89e-4f5c-b7e2-f8a59e2493c5", "value": 128460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352559, "uuid": "2104e6ea-efe5-444f-bd5a-f0fd56027c7b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352559, "uuid": "d553a995-60f4-48fc-b99a-2d73cbb06d3d", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b90679c-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785327348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327348, "uuid": "30bed685-069a-4664-b8f3-b79e8937f06c", "comment": "Malware payload (AgentTesla)", "value": "6f9805f36875190f0e427622ed985169", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327348, "uuid": "cc5b9714-e06a-4f9d-9cf9-db5b545f43b3", "comment": "Malware payload (AgentTesla)", "value": "c598ae0dd7ac49781d2068dfee9832ec0f577514d733877c6006a2e30b1943c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327348, "uuid": "d14ab698-dad0-4107-a105-9b0fa74ef212", "comment": "Malware payload (AgentTesla)", "value": "1fab924b072175668c49061b06e01ff6a1dbfc77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327348, "uuid": "0f4969b9-6c1d-434f-ae17-55ae2bac5fb2", "comment": "Malware payload (AgentTesla)", "value": "feffe39edafacbaaaf895e68ea58d99f8690f005e95605bc8be9b3e06f5f19f942fcc66ea0a35ddfe988790c8c44c4a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327348, "uuid": "2f07e720-f345-400a-bafd-0340d2114962", "value": "T1F6514DF6FA5D0452ED06CDB58223F0BF28A954ABD390168CD01950D4334D92FD44563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327348, "uuid": "fad6f2d3-93d9-4148-b212-da874254fe8a", "value": "48:dz29SQkQpohEghufSi/xWxSHFyRPLhaiLsLNnO6uptt3zll1Y2KyyXiyF1GxO/JF:dfCSiJWUly9t8NnO6ul3z31YpJf/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327348, "uuid": "ad318be3-26b5-4b09-94d8-f0edbfcc3090", "value": 3079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327348, "uuid": "78836fad-f93d-4a63-b06f-3ab95b801b23", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327348, "uuid": "d40623c7-169a-424b-ae07-508b294406fd", "value": "Revised_PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42113cc3-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307172, "uuid": "d6c8471a-e53c-45eb-ae9c-857241a43132", "comment": "Malware payload", "value": "6acda6b7d75955d333f66fb221a31d1b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307172, "uuid": "3a40d23c-c8dd-4ef1-8495-259e9ebfdee4", "comment": "Malware payload", "value": "c6524b7458b2235c221890f696846d82b82dd3f42f7bd5139f60eb7c708be0d1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307172, "uuid": "d6fe5dd9-df46-4aa2-a151-59409fb10821", "comment": "Malware payload", "value": "97424ec4b466a5e010aee0177891170e823f4da9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307172, "uuid": "ddafab43-aac4-4704-b553-e71b4dc3d688", "comment": "Malware payload", "value": "47b47b0794a581f5f8e06ac2b66b73c0e34922f487f6bd28e6eb81302aec69f9656e400c6c7367b2a7787ea1bf2f0212", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307172, "uuid": "60699c5d-8df4-4100-9236-f2fee7f0b3ae", "value": "T1A172E12689C64A46C72278D462DF19E9F248B797C851238D1FD23BFD4DA33441ECB326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307172, "uuid": "4a69af56-3ff9-4e24-9f67-2800c495bc0e", "value": "384:aAhsWRews6s2+Q/ioxhUkftg5CbgylISrMwy:aARRztXKo7nftoUNrMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307172, "uuid": "e9cddf7d-5a04-4f7f-af79-5ef6b673b372", "value": 16624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307172, "uuid": "7eac6751-12f6-4fa7-abcb-d940355a5d55", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307172, "uuid": "4b7a6774-a1e6-4f60-a298-d999801e18b7", "value": "images_20260728_084712.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298915bf-8af0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785289951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289951, "uuid": "cd0f9d7c-3229-41bc-99be-b5ceefa405a2", "comment": "Malware payload (Mirai)", "value": "97e9bd358da99b670578c833bf2fe245", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289951, "uuid": "9f1107cf-b5c4-46ec-90ff-99119bedb5e7", "comment": "Malware payload (Mirai)", "value": "c74820349ce06caf983178ef5ad7c8748afb1078caa98d66d1bb325a6f99d414", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289951, "uuid": "1a97ddae-a613-4752-b5d1-ed7c058ac429", "comment": "Malware payload (Mirai)", "value": "9d53153124d4888f69d32e0b2a34d73fc4202e29", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785289951, "uuid": "435c5aba-9f3b-4d45-8f53-248e2c93e50e", "comment": "Malware payload (Mirai)", "value": "86bd7f9978eb467a0f235fde1f91cbf99d19315fe9cc2610f48a52a20d2f590703a965f69797a668d788a2f40bc27a1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289951, "uuid": "4a121de7-9690-4c90-ae87-94581312860b", "value": "T13E01AFCAD26498404099C41D769F1154F831C3CA198BCBA4BF9CB43D9B54F10B036F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289951, "uuid": "9c152145-0c52-4196-a9ac-1e2883a3a147", "value": "24:kXCKysE2hi0ziQvZoha7FCrJBkDW31EuX:e9Qp+Ms7QDCS1EuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785289951, "uuid": "8cbbe766-cc6e-4ca8-9017-cddccc326fae", "value": 852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785289951, "uuid": "5bc7431a-7a6a-4140-af50-d8e98d4b05cb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785289951, "uuid": "3067fa17-302e-47b0-8630-de14759489da", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c907621-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333282, "uuid": "2d81f8bc-9b28-4b44-8908-5d6201c19eba", "comment": "Malware payload", "value": "b425f8d1834bbcd279f87d3b5133990c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333282, "uuid": "9ae4bc13-b8fe-42c1-81c3-0d80efe077a0", "comment": "Malware payload", "value": "c74a767e706428aa09fd7374d35f6b813cf35dbf1f0e8cc8defd80c85f97485b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333282, "uuid": "78190532-aaa9-4a12-a241-6ffba0e6b1f8", "comment": "Malware payload", "value": "052d35f95d3a6db45d103fbf2777e87e7e1e828e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333282, "uuid": "dc608659-310a-4f4d-8e05-e2982786dea3", "comment": "Malware payload", "value": "ea1dcca97d31be987a95a22b489633f042963a998f826723a6ee85091e4b0b5c586fb965210bb306d3de9f0d33788166", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333282, "uuid": "b2115d25-d8a3-4d6a-8b7d-e1f4bbb63853", "value": "T11301ABDAE2609D00102D886D639E91E0B431C3CB158B4F647FDC943DBB98A14B12EF94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333282, "uuid": "10157071-da59-4b95-9f8d-774c76ffa714", "value": "24:kXCKysE2hi0ziQvZohaQE5osHv5r+yF8Gc7:e9Qp+MsQGosHvMHP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333282, "uuid": "c8afe78d-2225-4d7a-bba0-10c13e35df65", "value": 843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333282, "uuid": "80db0727-76b6-4502-9631-a38edfdd516f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333282, "uuid": "4bd07175-dfd2-46b4-b3cf-ccc868934d8c", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28aeb477-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323880, "uuid": "71901455-9316-44eb-a12d-a41687ddc586", "comment": "Malware payload (Mirai)", "value": "f06408c2ed73d089486ec21f13476575", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323880, "uuid": "99a4c4ec-2de2-40d0-aedb-97c6df34acad", "comment": "Malware payload (Mirai)", "value": "c7efbd6038b27b51b39b30fcddfb91bbab0418997b9d05f639d0e053f23fb621", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323880, "uuid": "65c5f29f-249e-499c-805c-61c77cbacf81", "comment": "Malware payload (Mirai)", "value": "2de93dadf50f25b66c0c776b37eeb950ca7d7898", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323880, "uuid": "ecdad313-3440-4365-8d95-beed55c79d17", "comment": "Malware payload (Mirai)", "value": "d787b18e114368df790495ccfc1887a40d39e327250579563a938e8f1a8884129dc674ac0da48eff312732b2e5f0d888", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323880, "uuid": "3819344f-7a48-4923-bd8a-e54ad035e60c", "value": "T178930782BC81EA16C7D0137BFA6F108D3315A7D8E1DA3242DD251FA47BCA81F0D6B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323880, "uuid": "bfdd97fc-cd4b-4045-a48a-c2821a670d03", "value": "1536:V++xx3dnbK2Uk/sZ6WkYAU2wrWmHzsMgSrZKj/DUr9B8t46Thdo45Jnu9s:V+snbKxHA8tY/DQ/84whtJnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323880, "uuid": "33676736-e17f-4fff-bb30-05eb92430444", "value": 91132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323880, "uuid": "8e900a6e-6b97-465f-8400-4dcbee12eac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323880, "uuid": "c0e55586-a3fe-4854-b02e-00a49844711b", "value": "MMaaRRiiOisecTanee.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70eed9ea-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307251, "uuid": "b1e0bfce-0fb6-4f5a-9d45-442dd81c21af", "comment": "Malware payload", "value": "afad96bf155a8977b7f21ce91b836729", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307251, "uuid": "17a155a4-9d67-4b11-a831-4b76d3c23897", "comment": "Malware payload", "value": "c846a22aeea3b8f5d7108ab005bdc2131c517937f41d9567262d586b31570558", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307251, "uuid": "0a8c17ac-c96b-4b3c-b6b2-5901aed8c3ab", "comment": "Malware payload", "value": "1f0b29b866b57efa16b3c965c695190d957bc66a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307251, "uuid": "36ea511e-1b5c-477b-93a6-d6e9d0069301", "comment": "Malware payload", "value": "16791480576d48f641a16914a7d5efff1101e0dd7fe18e0c0fa3c320cfd138ddb67ed21cd11395b1c361a7dadd015b39", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307251, "uuid": "e5e2b344-ab17-4eb7-9fc5-72da5ac635a2", "value": "T1D572D04D7A5710A5AB9E61437CF7795F68173C899AC60F361FBB2A1B9D3C0A30017900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307251, "uuid": "719e3fd9-3e9e-411a-8757-029e9784742b", "value": "384:wYLBA93TMqr33E5aVneZ7bSiV8tf9Iqyajq2bWrFTdqbbsG0:wYLBjqw5eneNbFbDhFr1EnB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307251, "uuid": "c3ae0c07-9278-410d-be70-56744d87b8f6", "value": 16007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307251, "uuid": "646d2503-1153-4b53-ac10-3dc3d9c53db6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307251, "uuid": "543551c8-fd68-4d72-836c-21e1c9ae5626", "value": "images_20260728_173203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d685dd53-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307421, "uuid": "c0981eed-dc3c-4ddc-ad35-ca0f45c59823", "comment": "Malware payload", "value": "1cc61123e85f15bb4ee40e3a11784243", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307421, "uuid": "acdc1c80-26fe-4934-b73d-bf2caba4635e", "comment": "Malware payload", "value": "cb2dd0ca49f2b01b684d38f85e710781d8bfcb87b995ab2482ada5b7275c311b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307421, "uuid": "e2b31e0b-30b4-4058-88ca-5c9414eab806", "comment": "Malware payload", "value": "b8af4502530282efd3b60f622b20ded9e19f564d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307421, "uuid": "b034b49e-f6be-43ff-922a-f95a72c905d8", "comment": "Malware payload", "value": "a37cf737274c67feafa03e0114655f074a010a471f85422def651ba8e5857d7e91fbaf81846590476835370e0fe6622b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307421, "uuid": "07d08506-df62-4151-9bc1-b7d13b54f050", "value": "T1D0B16D1AE08556F6CBF774BAF48341CD9188C9CE5BB14682F42375EC80617F961E4768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307421, "uuid": "58cd5d61-8bcf-4bf0-8ca9-0b38ef03b848", "value": "96:yYUWkY4srlMriTcK/1nO7rK/BzHc4H2TJ9pNjc2RpVbGe/YY7n7sAkt:ESZMrqcK/1nOgTcJlSwb9l7n7s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307421, "uuid": "c97750ea-c7bf-47ec-9dcd-363dedfa4426", "value": 5121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307421, "uuid": "38ee7242-d240-4763-91ad-6cc709d30406", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307421, "uuid": "6cd06cf2-b82e-42b3-aed9-2f1d6a8875f2", "value": "images_20260728_143909.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db47861b-8b37-11f1-bd95-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1785320744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320744, "uuid": "e044233b-867f-463b-b522-548908148712", "comment": "Malware payload (GCleaner)", "value": "f651e9225960daeb8dfb96c3da275294", "object_relation": "md5", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320744, "uuid": "9db0653a-0e15-460c-9eca-54fdc5ddcfdf", "comment": "Malware payload (GCleaner)", "value": "cb8d68041200958ef7c8b1c5d5cb82c2545f2d89b67dd49c564242f2f009362c", "object_relation": "sha256", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320744, "uuid": "9fc4022d-e285-408f-9715-3642e27fc33f", "comment": "Malware payload (GCleaner)", "value": "34b5e8d7449ce558ec9aafc624e996844614a614", "object_relation": "sha1", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320744, "uuid": "bccb9a30-742b-4a5c-9384-e7cddc564103", "comment": "Malware payload (GCleaner)", "value": "9828702d2217f66e080d357d8844a2d99492e761aecc6f6271ea286c494229bff385dc8ace08b663d0bf6fe462e888d9", "object_relation": "sha3-384", "Tag": [ { "name": "80-76-49-77", "colour": "#7DA676", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320744, "uuid": "3cce103d-85be-4335-a7ff-a439d63933a3", "value": "T1362522A157EAC117C548033159E2E37203B8CE88F963DA6B5FDDAEC7B92375A5C41382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320744, "uuid": "8a436f61-5155-4e96-ac32-050da644ff36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320744, "uuid": "93577622-9795-4f45-af8d-1203db057e0c", "value": "24576:enODWmdY07kLqqUIgHYBzGZboBpMPQUeKRWD0Uy88PwPl:2KY0djIEYBzgborMPRRdUy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320744, "uuid": "f6d2710d-7ad2-404b-90fe-40297e308b4e", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320744, "uuid": "d3f281c7-197e-48ce-b4b4-4bdf499d6c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320744, "uuid": "e3df4d6f-6b76-413b-b517-8f77a648f6ad", "value": "cb8d68041200958ef7c8b1c5d5cb82c2545f2d89b67dd49c564242f2f009362c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad714339-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305205, "uuid": "fcdf2bd0-e9d0-44c4-9c15-c8b252f980ac", "comment": "Malware payload (Copybara)", "value": "abd57a48bfa57c6ad000806e080aa97f", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305205, "uuid": "3f6e9f7a-a511-4f08-ac02-5fae4147d8a1", "comment": "Malware payload (Copybara)", "value": "cba19f8eedf90c332224bcd8f0df9be0e1dbd4324c67c79eef19d547c33ef331", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305205, "uuid": "ed627595-2bef-4a56-a014-d79cb4ba8029", "comment": "Malware payload (Copybara)", "value": "bf13f68a3b8faf43200a12909cb2fb33b4e578e3", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305205, "uuid": "af1ae934-4300-4c5a-a904-48cc9865a156", "comment": "Malware payload (Copybara)", "value": "4bcd7596d433195ccf6d8be046878813104d5ae74348df85a1c7111500dedd3dfad1cfffc28c0032117aa9b6719290d6", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305205, "uuid": "3a37d352-edb9-4820-a069-3ec8131e60b6", "value": "T1CEA63306B38A5B9DE07647734C60A299117B3C19CF63832752017B3C69FB9D90B67EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305205, "uuid": "f91c4b0e-2ed0-4ef6-b287-dd3123a36cd9", "value": "196608:w71wWwPLCLH+QN4ut1eMSTp7l2olhYrsjdKSCBYNLngukc5kPDmreTTlhW3U0i:g1xwPmLH+luHeF17FjRfjLnguvkrmruL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305205, "uuid": "b0f2a806-70ac-4c48-9266-cfb2ca910be4", "value": 9980464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305205, "uuid": "1122d326-5f2c-43ce-bc47-273a441f807f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305205, "uuid": "afde5fe2-527e-493d-a75a-e5766983c3f2", "value": "cba19f8eedf90c332224bcd8f0df9be0e1dbd4324c67c79eef19d547c33ef331.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11b34da-8b11-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1785304352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304352, "uuid": "7f50b1d0-4f2d-42c5-80d8-3f26865927d0", "comment": "Malware payload (Efimer)", "value": "ac2502323c70e750e636bc9f6768c259", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304352, "uuid": "de12b189-4711-49cf-8610-b2aef1c803ce", "comment": "Malware payload (Efimer)", "value": "cc21168e7a28352288ff3daea0adaa3c7a4ace0b7c07a1411039c5dd6d47c66f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304352, "uuid": "c9133ae4-01be-4557-86db-f34aa08174a0", "comment": "Malware payload (Efimer)", "value": "e08fd0dd53734af15539a97f7cd03cf71772f114", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304352, "uuid": "a8927db5-ce0a-4497-abd0-f861b6a752b8", "comment": "Malware payload (Efimer)", "value": "86886cbf0c6acf574b762afc2f6fb35a788d66ff9ee2f6d7c5e622e221dbef79bb84156b9c0542942ded2a806b2c4409", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304352, "uuid": "9cd24923-f135-4068-810c-5d25db63639f", "value": "T177E6331853D406EEFAB3C63DEAF10D6AD5ACB0A81732C55F53D883A1AD172E58D38217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304352, "uuid": "f260a84b-0783-4f3e-b59e-d7d8c6ce6c2f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304352, "uuid": "49b376a4-9d51-4c59-9136-3a13d815ba18", "value": "393216:GsmC8H5Pf0ZvtefAmomFMHXMCHWUjXNcuI3/PGTAI:Gs82gf/omeHXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785304352, "uuid": "2b7d63a5-d193-4839-b09c-76553df2931e", "value": 14311543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785304352, "uuid": "a35ceb3e-4d47-425b-a0a3-2aef6a951138", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304352, "uuid": "2833e22d-ddcb-4544-9971-ff83f040a82f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b95574-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351579, "uuid": "12c77e0b-ccac-4198-98ef-edf9ea583565", "comment": "Malware payload (Mirai)", "value": "5f45c48cabf288ea90c25b74276b165d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351579, "uuid": "511a455a-190f-4c4b-a437-105ee06b045f", "comment": "Malware payload (Mirai)", "value": "cc5415249cfa840db5c5fad2c439851d84276966ba7206864232119482786ca0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351579, "uuid": "5d710ea5-e1c2-4d84-ae60-ee81483e15f5", "comment": "Malware payload (Mirai)", "value": "0f6f039725cc1575f721dfae13fd89e8dffb0b41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351579, "uuid": "eed64687-567e-44e5-b9b7-02046af4319e", "comment": "Malware payload (Mirai)", "value": "d5cbc6777fc1711bbcff85261fb7a905fa61b7560aefc6a621121fda17a4a5157648b182f6a0e1ab3039a478202c7fb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351579, "uuid": "dce98b33-2afc-4cb2-b057-947011e1d2e7", "value": "T1B0C32AA9F880DE62C6D5267AFB4E418C33231778D3DE7105CE149E3467EB95A0E3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351579, "uuid": "22e3ff2e-6120-44ff-ab9b-e756ac8ec375", "value": "3072:CON9L2wOtnosmfncYEEU0084WnCwlDBteiMALe++pO5aA1Dz:COTAmvcYEEU0HnphBteipW0amn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351579, "uuid": "8b275aee-fd2c-4cfc-9d26-f262da0816b5", "value": 128460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351579, "uuid": "25cc4e80-f98e-4061-8a10-67acec4a4eb6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351579, "uuid": "1cdaacdf-9c84-4c5e-9a34-b3ee1a4cc414", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c7bbc5-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785351519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351519, "uuid": "df6b042e-73f0-4231-b639-aa384f0bea0e", "comment": "Malware payload", "value": "1e38ba9adea756bca14d16393aaf33e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351519, "uuid": "2117eca7-3be3-4bef-93d5-ddf8acb36c81", "comment": "Malware payload", "value": "cce828a00157a6752738f4d54974b7c85ead80685553f856015cd2625088049e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351519, "uuid": "11b9963f-d864-4f0d-8978-716a9e6d4740", "comment": "Malware payload", "value": "f5a6f8033d58c5901154adfc1de78414b7f017e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351519, "uuid": "5badb95b-bcae-4464-8503-b2f249646e5e", "comment": "Malware payload", "value": "405d7691047d9ed9b1c8154260fb0148fe3f77bd4d5b9e65460bf75425efd262dc5905268b9c3c82954e2c0384f4333b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351519, "uuid": "12699000-50da-458c-90df-9723ede24bf2", "value": "T197D34B06B70C0943D1632EF43B3B27E193DFDA9124E4FB40251FAA8A9275D32558ADDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351519, "uuid": "29a4afd8-3092-4506-87b0-d0418ed119b6", "value": "1536:RTDClYZlS9sSpxkxbgDBIrsPOxcrtumWTUlUVGiEZOhiI8pAvAky6fB8Aq0LZXcr:5DC8exKMIMuGifhSFk+se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351519, "uuid": "47b93da9-7040-4631-9a4f-531eda075a83", "value": 142972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351519, "uuid": "8042ff7c-b65a-4b2a-9199-4297c48ac62c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351519, "uuid": "60aca417-72df-4760-8d9b-cbb04d27829c", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef862e4b-8b4a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785328938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328938, "uuid": "ff096532-20bc-4c61-a72c-0ec4f543ee52", "comment": "Malware payload", "value": "21157c4aa6cd33f9e1d889c3089ca81d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328938, "uuid": "db763da8-7324-4c2d-935e-13686ad5eacc", "comment": "Malware payload", "value": "cded0a69f7e9884f965e83c9c7ee3523c92b676abb38905ba0cdf88d92825638", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328938, "uuid": "63336c15-c940-450f-9477-39e99508ff3a", "comment": "Malware payload", "value": "c389c4531d374289b8d4839201ebbc060e195b8b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785328938, "uuid": "d0ae62b1-4b47-4a82-84c5-b4a3e5389338", "comment": "Malware payload", "value": "6c7200891ee935e378be017bb33f3e064b9df56d95a4c3e01a4be3ff549b8fd836ff949689f8984b3009ed0ce06a5bcd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328938, "uuid": "12ff58a0-0fe7-4b3c-8a30-2e3c9db05079", "value": "T145314187229602F53DF2DABF71A98425B284F09A3DD4DE39F4EE78B5424DD4C7046A83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328938, "uuid": "72414107-3671-43fc-9def-cbafcdd870fd", "value": "24:vhQLYoVhlRhTRjhAAwuGhhoWho6so+6ihWtW+rhFsGwhosmos66ho0omhoOo1:vWFxnZylqI+6iUw+rzGqOF6qhmqj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785328938, "uuid": "5bfc9d6e-3e4d-48f3-9075-0a4f8775c75d", "value": 1850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785328938, "uuid": "0a585340-6af8-4ef3-84ea-17a3a002e8e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785328938, "uuid": "df952859-4779-4ef4-a745-10d768f39347", "value": "Mugen.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ccdb7f-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785320914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320914, "uuid": "91056ce9-92a1-4e7f-85cd-15ce50586793", "comment": "Malware payload (Stealc)", "value": "21aa4b32defa0fa0aea3e28559ee8fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320914, "uuid": "442a9b82-a1d0-4928-931e-f32e2f8c1e70", "comment": "Malware payload (Stealc)", "value": "cea15fe7edd6b1b26f4326901781c16034ebe195cdb89ede2338e91c1d7ce6ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320914, "uuid": "a6320de0-716d-473c-989e-898e1c16ac09", "comment": "Malware payload (Stealc)", "value": "0ec48459dc967e7e8c8e83fd193c09521ffdb01d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785320914, "uuid": "c67e151c-6e3d-43b4-a53f-a0982fed1ccf", "comment": "Malware payload (Stealc)", "value": "f37453c0daa8b9fc8e7ac4ca274d655eeb0a382d914472cd40f47c8e2ca8a8fe72f495d26be50c4d2a0a33ab8becbd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320914, "uuid": "56891b0d-ff10-429a-b25a-a4de8c62ac7b", "value": "T1BBF48C1BA7A502F8D07FC174CA524942EB72BC565331A7CF03E15AA61F376A05B3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320914, "uuid": "d0de2b9f-fe14-491f-8d21-36301ab0c83c", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320914, "uuid": "127051fb-4313-4bf9-a1fd-743332bd0ff2", "value": "12288:T6HSXamiqz8TbhvbTOMfJr6EmTcMiESyxBlDetAqxSvyc:HakzIbhvbCCJ+pTCESybq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785320914, "uuid": "b04ab648-3733-4a29-80a1-4a5d101a7521", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785320914, "uuid": "f92c4997-004d-4db6-addb-293681c89e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785320914, "uuid": "9324579a-63e8-4df6-b8f8-718dcb98e61b", "value": "cea15fe7edd6b1b26f4326901781c16034ebe195cdb89ede2338e91c1d7ce6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af55d71b-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349876, "uuid": "f6fc66de-ccfb-4cc7-bceb-97df051fd652", "comment": "Malware payload (Mirai)", "value": "fbc3ba4047f4dfac3af415d332f7e7ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349876, "uuid": "88e1399f-2b14-4cd6-b9dd-3ef094bec579", "comment": "Malware payload (Mirai)", "value": "cf44153b92da38b641a45988f6bdc1024c8c9482305ca024897a51636ce59d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349876, "uuid": "acd0874b-a5a8-4ea5-b6f2-23478034e1d9", "comment": "Malware payload (Mirai)", "value": "f5aee873947d7051b56857d82213b7be04757eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349876, "uuid": "cd25ce42-c5f5-4184-be1c-6f95eab258dc", "comment": "Malware payload (Mirai)", "value": "9dc12e149ac6af018a377e5b18144156afda852b5954f55ca9a89c21b5fd040b465dc7ebabf7ccc88380c7aac360cd43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349876, "uuid": "bdcca116-bf1a-4ac0-997f-465d64d3058e", "value": "T182E37C49FA97C0F0E2D341F5012BE76A563A9D116133F5E6FF462B61FCB1302698A26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349876, "uuid": "b582d4c0-2574-4038-80c4-1d4bbe9ddad1", "value": "3072:Sn9Cslzlu1eYlo30tvEWg/q+sk3TJf7+0ao/45YVGIs913rl/e:Zslzlu1eYlo30qWg/7fqkaYVu9tlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349876, "uuid": "7a4ed917-8e0e-4faf-80e6-76a57518756a", "value": 148864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349876, "uuid": "4a472522-32fc-4aee-b77b-6250bfd9b0ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349876, "uuid": "9f040d62-b550-495a-8c06-aa2b95337b64", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd646de8-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324586, "uuid": "7b992f9b-f266-40e7-96fb-99a2a9ecebc9", "comment": "Malware payload", "value": "1ed2f3cb19cd580e22f96d59b4097592", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324586, "uuid": "92894e47-ba72-412f-bf9d-70918d813af6", "comment": "Malware payload", "value": "cf4542d34db7c9156ae66d879818783058d3bb5bd6c4b004c6f7d4cbcec8e707", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324586, "uuid": "0708259e-a78c-47b7-9524-ecba041c05c4", "comment": "Malware payload", "value": "f29ff5a719ff836eabf350ba6bd9d3b0f390167a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324586, "uuid": "fc5ca375-3eb3-4650-89fb-044a54b6da2a", "comment": "Malware payload", "value": "59c70644eaee513336446f3dbe873bd8d23ba97057f3ba518e274e3a7c7faadaad9ed742084e5e5164a175b27b578c56", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324586, "uuid": "b142cb34-1e05-4295-9fdb-c4962ac56ab4", "value": "T13021D590829C86ADC01FD571F821FC05213908AC501FC7E7927AE5B15F17F9A23986E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324586, "uuid": "028d6807-7436-4874-9fe6-6b61ed630a69", "value": "24:9UrO9G2S9O5KbjYjOnuySJQo1boRVR8fpB3O57N9Mmk8RA4P/OINoVJ6Mbqav1nG:9Uy9GVOEOnQ6bXpwtN9MT8R3ZoVJ6Mb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324586, "uuid": "5cd20627-018a-4a15-aa0a-6f7b37fd1c6c", "value": 1399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324586, "uuid": "aeda5120-753d-481d-93e8-d7e626435ab2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324586, "uuid": "0b5bfbe3-6fd3-45a2-8cda-d618804ec85f", "value": "photov_709235722792.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e845e2-8af8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785293544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293544, "uuid": "73c80b61-ad5e-4793-ba83-bd677442fc94", "comment": "Malware payload (Phorpiex)", "value": "a74be2b7ab2e316dbd6df0e295255c0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293544, "uuid": "add009e1-5181-400f-85f9-6e0d9760447a", "comment": "Malware payload (Phorpiex)", "value": "cf8b604d9e3f1dc4470ad1e5cdf8922a3a84021b08ee8b0700b76ea63e0781fb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293544, "uuid": "1c87a914-11ac-4b5a-a75a-644ad57d9e17", "comment": "Malware payload (Phorpiex)", "value": "460e33b14cceb514393ca54fe3abb8eb33808b15", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785293544, "uuid": "0ffa247d-419e-4904-8fc7-37b425e96fe4", "comment": "Malware payload (Phorpiex)", "value": "d5ed0607f40ca64b9a432572a9cc848c98861bee76410cded106dfc654c11d7ecb777936cb2d909c56cf1fbeb7d28d03", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293544, "uuid": "385b0c4a-b315-41dc-8947-7c399d20c55c", "value": "T179823A0FB8424216E1D110B4957596BBD9B99C7633C418DBFBD44AEE1A686C1FC3250F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293544, "uuid": "e0e743d4-b7c4-43ec-8935-ed1b41cb4b10", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293544, "uuid": "52f56637-e505-4128-927e-df55a21dc9d3", "value": "192:AW26SkQzngjoWLsmBDTlIUqRQQPcleSMv9fKUSiu9zwfge+VOgbOOqmEd6FQv9P6:ANZbmsmBTQU0Vu94gXTPuav8U9c+w4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785293544, "uuid": "22357858-73ae-431d-ace3-01d87744ebc1", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785293544, "uuid": "2d21acc1-f3f2-40af-93ee-2bb5154d7654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785293544, "uuid": "e56c613b-0a8a-439a-947c-52dd9f03a9e3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7733a9b6-8b5b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785336038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336038, "uuid": "8d93e949-f52f-439c-a7bb-c28cf77ea38a", "comment": "Malware payload", "value": "077f193c894d6d3b6626bc20b2c9a994", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336038, "uuid": "6825c11a-72dd-4518-9cc2-28e628180e8d", "comment": "Malware payload", "value": "d05b01e00340c5c566b5866d86146d22adffb56d94af14a658b91cb0dfb2026b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336038, "uuid": "308f3dee-f256-411e-b1ff-f693a9547584", "comment": "Malware payload", "value": "e38f778f0a05db77c36e75a1aee77c07e20984b1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336038, "uuid": "38073008-8af3-43d7-86fd-ed320a6a150e", "comment": "Malware payload", "value": "6ddf81e6c9cb76065b13059c860a6184665575accbeb49fe60fc293f42268473640ec415180aa6c67772d40adee903ed", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336038, "uuid": "60358067-6014-48e9-a5bd-2c1b3c97c164", "value": "T113C27D956A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336038, "uuid": "a49de1b2-f7f3-4b5e-8d5e-c3db26cf88af", "value": "768:+8vCB+25j6es8R6W9FYpMSUpi+20qUpi+20YQX:+8l25Jhd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336038, "uuid": "d8e60c47-8a56-4d3e-943e-97b3d33b96aa", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336038, "uuid": "17e461fb-79ca-4cae-9103-7f7c7a7d602e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336038, "uuid": "93efa359-a390-4f54-b755-980de845867c", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e04ab9-8b87-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354751, "uuid": "e78975b8-5300-435b-b002-feb1f8045f16", "comment": "Malware payload", "value": "7e156047d9217122c15da13f2c8765a5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354751, "uuid": "f184ed7e-51f4-4090-a1fa-741f27b47b62", "comment": "Malware payload", "value": "d0c0dc10447e81afa7b17ececeb7ad616a8a7b58fa9dbe70f03165fcea0a9f71", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354751, "uuid": "138af04c-bb1c-4b10-9cc7-2f72f2620a18", "comment": "Malware payload", "value": "69959abe409438a3f0a7b5a48c6ee0eba89e52f2", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354751, "uuid": "fd507911-a795-4f60-a8e4-1bf1290b6352", "comment": "Malware payload", "value": "c8ca297ae5839b7e94cfebd5a7d26e9f3baa30ccd119c725249239abea8d18adb1d4046a6f4e30b34576ab579e17aff9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354751, "uuid": "aafec971-e9ea-4f60-baa6-1a55c523b98e", "value": "T1BCE6335467D021FEF6B2403DB8B21E97E9A578B60733C49F67A853526F032A44E38727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354751, "uuid": "8dc52881-c9c8-472b-b864-5d7cbd65dae3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354751, "uuid": "36b1db60-c00f-429b-839a-0b2c8d392f38", "value": "393216:lgJyavLDOC3qMCYXMCHWUjXQcuI3/PGTAI:lgpLvnCYXMb8XFH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354751, "uuid": "19156e1e-ba10-408d-9b89-54c2f20256f5", "value": 14323360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354751, "uuid": "8be172da-29bf-482a-8619-70ca813fb3d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354751, "uuid": "a89510d9-0ea9-408f-bd78-312a61a30494", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b90293b-8b3e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785323563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323563, "uuid": "32a52cf0-643e-4f01-bb0f-bfec1828adf8", "comment": "Malware payload", "value": "aee2774fd0ec1fbc101ca3e54934b53f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323563, "uuid": "cff77456-1997-4623-8541-8ff1f51d39ca", "comment": "Malware payload", "value": "d1226435633f94e588dd20b6d15540dc18f30dcc3df1111795f24ef5d60cff06", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323563, "uuid": "a5f16187-b18b-4fc9-9a64-5e8a6a1c28ec", "comment": "Malware payload", "value": "1a48791498a864ab3173abf3e8849f38314e555f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323563, "uuid": "0a4a2d26-77af-4330-b189-da04df67301b", "comment": "Malware payload", "value": "53310589165af4aa2c90f9f14d4878982a5e21cf44c31d94b7204c388d04f6394438af25414aeeb77469f88972b46548", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kemaxglobalshippings-com", "colour": "#2B1066", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323563, "uuid": "a17a65ee-7096-4792-97b0-593935854839", "value": "T118279ED6B3C40B54D45ACB30CA2BD722C2F2F8160635D28B5BFDF6461E72B924B7A611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323563, "uuid": "2928c673-66a8-486f-b45e-426c09a8fe53", "value": "6568c79245e4d4346739df553a990fdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323563, "uuid": "5f970115-fb90-408d-8f33-21cb6d3d6578", "value": "98304:UtxzNiAylev9XiQVHwKfNPh+gmABBJv2pG9jwvuLvdmbSa:UdiAVFXiu5VPh+3uL2pG9jvdmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323563, "uuid": "ac1e1cef-5ad2-4141-b6c0-a5d53122ad45", "value": 22063104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323563, "uuid": "5fc6a2b5-d8b8-4206-9aff-fdd1e13f16b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323563, "uuid": "49036b56-b64e-4d20-8759-c7004ea15712", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b5475d-8b0a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1785301112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301112, "uuid": "178456d4-15fb-46d0-992f-46dc9c376fdc", "comment": "Malware payload (Formbook)", "value": "ad4932cebb063cec58949209fc390972", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301112, "uuid": "32d8c9be-1da4-4fed-99fa-eb5238f929d8", "comment": "Malware payload (Formbook)", "value": "d13e4f45c26c3df8489825dc8b2ffa89ba85f9ea6bd13b76a8b4c8ff061d35ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301112, "uuid": "529585e4-9321-4207-9356-de603e999671", "comment": "Malware payload (Formbook)", "value": "d2af53a2c8e4ba11b8ba9b19b16d1935001c6479", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785301112, "uuid": "f0107e38-f791-4522-9eae-a006368d72aa", "comment": "Malware payload (Formbook)", "value": "cad676c6845301a6ab85d5c653a93b916af9c6ce120c04cb82997976ed437939fcda22286ce11c32d95b1d6d22f8655d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301112, "uuid": "8c5faf71-f2b7-4eb8-b28e-81651483cdfb", "value": "T14163FC541986B044633767BFB22B98E5E776063B01A42C17B83C7854DFB2D09DEE0DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301112, "uuid": "46086e92-f53f-4edc-ba73-ef88bf0ce11d", "value": "768:cvcPaFN6/E7arZAueq4v4eXHLTeZALKbrlOXG2aigKsXAGzmqecNBxAL8DbUYAav:LsUZwP4EL5Zy8wDxVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785301112, "uuid": "629ba752-6115-4d92-a856-e970c69bbbe2", "value": 68291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785301112, "uuid": "5bbf4328-daa6-4dad-ae5c-8c6704b7df9b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785301112, "uuid": "8df160ac-b362-47b9-b32c-e5f4ea6975a7", "value": "July Invoice_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22965578-8b8a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785356082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356082, "uuid": "6dece47b-b724-452f-b4ea-8f22541d1584", "comment": "Malware payload (Mirai)", "value": "34b7b98f441482c064c5265244cc9959", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356082, "uuid": "44e68e70-008e-40e1-97a5-7dac9b7d5e05", "comment": "Malware payload (Mirai)", "value": "d1b8110868977a697f191498c1bd2ff1ea7ca469d1a7632b07411236dd75002d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356082, "uuid": "200a030b-b42f-462b-a703-bdccbd5832fa", "comment": "Malware payload (Mirai)", "value": "2f775d263b7c7edb840185a5efaac8fc8caef3f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785356082, "uuid": "2fa2a99d-f94b-4550-a178-10ee11c2a79f", "comment": "Malware payload (Mirai)", "value": "21b19aeb76d5111be59b24c92134f2dff0a2824da0ccc151542f4650e2b44a416bb26cb4cd6a99f3c3e29070a866130c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356082, "uuid": "e8bf41ad-e12a-4e54-984c-9b0a0207d76e", "value": "T197044A02772D0D03D1A32EB03B3B67E097EF999221A4B541345E6F9E9075E336946ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356082, "uuid": "51b8f18c-6e8d-412f-87f2-1ee7cc8b98c9", "value": "3072:UcocDro3xdYKr7yKfIxHxN/G9Pfk2BcoC1J:1B3o3wKSxN/G9nVcoGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785356082, "uuid": "690f3716-1aac-4849-ac91-e70e6ed7eaae", "value": 173848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785356082, "uuid": "82a4b1e1-0bb6-4625-a512-0a42a2e54627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785356082, "uuid": "6e978129-1e9e-4498-b6bd-abed734b45d1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda68345-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307460, "uuid": "558367ad-6450-4991-aa39-9db8a28bd74e", "comment": "Malware payload", "value": "e389394ddf91f89ffa49ad5958122dd7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307460, "uuid": "be9354ed-1abc-4fd8-8a16-ecf6b446b940", "comment": "Malware payload", "value": "d28f8996e7950f461242a43a37f6b9caa37a82f44d64e47d8570041b09aba6f9", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307460, "uuid": "50201d8a-cf21-46be-b48d-a315b9fa66a7", "comment": "Malware payload", "value": "5d3f9fc4a2d2732fd3a9b757adec4974fad40890", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307460, "uuid": "44ad06a9-da14-42c8-b231-0d709d99d6b8", "comment": "Malware payload", "value": "cce53e604e47fb1d26bbed00f05f4d7460578caff572d45e236525eaf9b1f004ba20c27451b92a7993440e7d0e130bce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307460, "uuid": "e0eec452-dcf2-4b44-8c4e-e0518f55207d", "value": "T12A41A6898ABC1D43CBF7BDB179D166CA631D61CB15317213370881D61A37877BBAA290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307460, "uuid": "b28a6214-0741-4452-8a75-9a92c1534960", "value": "48:9fUdWfR13K8BBSnpYzYKkwRWb64joDI1D7hKMWrUD:H51jBYpzM4jQI1O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307460, "uuid": "9b193a73-1309-4f99-a085-a178412eb033", "value": 1950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307460, "uuid": "5436789f-e28c-49a3-84c8-2ea20e161464", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307460, "uuid": "7fcd045f-3be3-4948-ba99-0c908933dc2b", "value": "images_20260728_161305.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e49089-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333157, "uuid": "0ab469a1-5ec7-4006-8074-4fa1f2871bc4", "comment": "Malware payload (Mirai)", "value": "660a8eec525f7a30503998ab642eee51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333157, "uuid": "cee6e8a8-278e-4969-a415-ea287e378380", "comment": "Malware payload (Mirai)", "value": "d2e0923affdd8ca0f40ab962dad3358df6380c319869f09d27bc8b8a8ad22101", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333157, "uuid": "eadc0c21-8ce7-496f-abf0-d1bde3ac5f20", "comment": "Malware payload (Mirai)", "value": "c23ac8454698f5febbf18ab808c246f24a74ac40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333157, "uuid": "4d9b52a2-e328-4779-9be3-a7806e2373ec", "comment": "Malware payload (Mirai)", "value": "4881796bd2363325dd5b6ca503fa374fbe02a65151dff86588490168a5479134792fd0624b830b837f5e87f2d35f23e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333157, "uuid": "f780f190-a23f-4300-9664-b23eace4f843", "value": "T1F3D31945FD419F17C6C265BBFF4E428D7B2A1768D2EE720399256F20378B85A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333157, "uuid": "39ea1ca9-6033-4ef5-9889-5e00dcbca9d5", "value": "3072:3WK/SKQXw3ZILW4LwY9X7mF+ZST6JXQ2KELa:33SoJqW4LwKX7s+ZXJAnya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333157, "uuid": "b38baf37-b2b9-4134-b558-508c907f1502", "value": 140760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333157, "uuid": "0f8ca003-baf3-40d7-a293-3d433f0be58f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333157, "uuid": "b58ea56c-7605-44a6-9fc4-4ccb665b84dd", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c93645-8b3a-11f1-bd95-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1785321758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321758, "uuid": "fe9ed061-2467-4f98-8297-a1f51a8c3c1d", "comment": "Malware payload (GCleaner)", "value": "127f833a0f80b73664cfa547065265da", "object_relation": "md5", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321758, "uuid": "30981a3f-8c7a-49be-adf7-257f7facdee3", "comment": "Malware payload (GCleaner)", "value": "d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835", "object_relation": "sha256", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321758, "uuid": "64c637ac-5b07-4ed8-9a94-ab59309be588", "comment": "Malware payload (GCleaner)", "value": "b2c29d38103a0ebbaeed3d575efeb8da989d17a7", "object_relation": "sha1", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321758, "uuid": "931c08fd-5c4d-4a97-92f5-56c70fea3b94", "comment": "Malware payload (GCleaner)", "value": "bbd858d53a12fd4a1b7d6cdf3e11f4004f34e80c4cab3d7f826c60810266669496b638c5f799665c2d79f80a342f483e", "object_relation": "sha3-384", "Tag": [ { "name": "134-195-88-33", "colour": "#24E2DF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321758, "uuid": "eb3f8d11-b9bb-4c13-91b6-df7beccfc5a8", "value": "T14ED53304A289CA22C1884776C9F1F0761774DD48F51BF2AF7AEC6EDBB2133391D54992", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321758, "uuid": "b08af5ff-c1e6-4685-8201-768a95ea73ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321758, "uuid": "00ee1812-7240-4912-911e-efca0a7332e4", "value": "49152:bdo+yqWbQ+TscTI96A9EjcfmITpp9elSpRF+5MvD6QpwU9iBlaAj8:2+yqWbQ+4c09JejcuITpvpSkJpwHBlRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321758, "uuid": "2656bd61-0232-4e45-b9e4-21d6ce9f5e97", "value": 2844160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321758, "uuid": "0e7e500a-419d-455d-bd5e-888d10e00306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321758, "uuid": "5b52980b-cabe-4c82-8ea0-de4c0a1c042c", "value": "d35d30ccc119aacab7cbf48fdddb54a9149507f79e99d102e37b43958e80e835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f74dcf7-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333877, "uuid": "9085024e-f927-42f9-99d7-43c91f53a0ae", "comment": "Malware payload (Mirai)", "value": "1a0aedf2a02d8ec1255c16d5d7c12899", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333877, "uuid": "167d5512-8f1d-4906-94a2-765817cd53f8", "comment": "Malware payload (Mirai)", "value": "d380f9a174bfd62bc70b845fdcd4e6043dd0d74d140326354caf1a5342fb7f77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333877, "uuid": "4223bbda-b89d-46f9-a6e9-977dfc2a5006", "comment": "Malware payload (Mirai)", "value": "2556e0ec3cde8a7f98c1942abec680f2c249c3d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333877, "uuid": "8d846545-7632-4fc7-aa9b-463df68ac5ef", "comment": "Malware payload (Mirai)", "value": "f406f9c272ef01a01de7dce83230e5d972f237585e856dbaebef697a73829f51c89ca12ddd510b64c7a08f7267556941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333877, "uuid": "f49ddbdc-93b1-482b-9d28-4ebc46694860", "value": "T14824A74F7E239F7DF6B887344BB35E216A5923C523E0D584D1ACC6501E6029E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333877, "uuid": "c85ca915-f3de-4fb8-9cfd-efadcb9e5b62", "value": "3072:XKoQBRpdhO0bapuBZhspP+XrhvngmisZTDCqfF6W7u1udz:aoQnM6euBZhspP4TZacFp7u1udz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333877, "uuid": "94cf914b-77b5-4b60-a3e4-1fb305957065", "value": 218484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333877, "uuid": "f56684dd-bbb0-4ded-9950-5d27b92a31a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333877, "uuid": "b726c696-8299-4b53-b2d7-f906911ad6d0", "value": "zero.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58eee3c-8b12-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785304762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304762, "uuid": "e868b799-8a9d-47ae-b788-b41cbcede0fb", "comment": "Malware payload", "value": "e9d6d975965116893de1b3fa3f19ce2b", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304762, "uuid": "419a780e-e34d-475f-9717-30d1d84c167f", "comment": "Malware payload", "value": "d51f7074611b7384b6405179826b559f0b0682d6034750eae21f81085007e3ee", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304762, "uuid": "5e4483e1-50ea-4d75-87aa-f1fcc87a2536", "comment": "Malware payload", "value": "ddfc5d2630281d6a1a0ab91dd823bb0e4652a696", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785304762, "uuid": "10cad37a-251d-4796-b6df-fd6cddcfa7dc", "comment": "Malware payload", "value": "0edb6164005778a42df0e6d2d90a3694a920fc4e82f3307e71a71200bf210e545bd47630bb6a7acd3fcb18db3a06c427", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304762, "uuid": "f7b3d5e6-3bac-457e-b02f-abeac01037bd", "value": "T1D9D02354590B9155C1132017417CFA5CF40D794104D1DCDC6751DD4F2C940E1C5567FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304762, "uuid": "9a429f95-680e-4743-ae60-1bb25c83997a", "value": "6:HRYFVmjUdxRRMes2yg6msJWbB6yMQs7A54vVG/4xHy:HRYFVmkxRps2D6moWl6yMvrVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785304762, "uuid": "cd00100e-4391-48d4-ae43-1f6ad096b69c", "value": 207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785304762, "uuid": "d66b06cd-a56c-4733-b1de-b21f0177da99", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785304762, "uuid": "fde9a08d-1f8b-4df1-9190-aff091b98ee3", "value": "d51f7074611b7384b6405179826b559f0b0682d6034750eae21f81085007e3ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0942295f-8b5c-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785336283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336283, "uuid": "b366f87b-a526-447d-bf84-a3a5cbddc485", "comment": "Malware payload (VIPKeylogger)", "value": "ed30d983e85e2335d1c18c27f5a99111", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336283, "uuid": "1170878d-1f13-4194-b0a7-d66c9551784c", "comment": "Malware payload (VIPKeylogger)", "value": "d536a74a0d4e7beb230e9f36db8c302a3dd7d18dc2b50322680aa497b45cc1fa", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336283, "uuid": "36cb7078-c047-4a61-9abe-57fb66678752", "comment": "Malware payload (VIPKeylogger)", "value": "5c97e1b43c16b526314cd4c0b04afc0074a4de56", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785336283, "uuid": "478aade4-28eb-4143-9e06-5652e65d52a7", "comment": "Malware payload (VIPKeylogger)", "value": "14430420b11e2df39e7e252ffb51458a8555e7035bdcc0c0644a17fc31786815db9070d1a73485b5b31777b559d39898", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336283, "uuid": "3b251b13-29fc-4e89-9972-463a676f75c1", "value": "T115D5B2D442CC6A994479FF64BF9BD8396732BAFA9186AED20B134C12DC10838677C5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336283, "uuid": "a850cd33-156f-40b8-83d9-dc129da9fb67", "value": "768:oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAO:Hz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785336283, "uuid": "4d226d50-df3f-4e50-8cf8-76bd2fe7363f", "value": 2830598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785336283, "uuid": "a7fbd2a1-307f-4f3d-b903-901f8b6c0310", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785336283, "uuid": "a332c397-17d2-4c76-8a9d-7064d0e64c7a", "value": "RESM\u0130 TEKL\u0130F TALEP FORMU PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fbeba7-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323874, "uuid": "c2307c63-b5bc-441f-a0cd-767fad3d4a22", "comment": "Malware payload (Mirai)", "value": "17d90218cb238a61b2dd6f6140deeb3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323874, "uuid": "8818cf01-2851-430d-a635-0d21476c4540", "comment": "Malware payload (Mirai)", "value": "d58dfeb75e2341d975e48d9553767909c176df178844215bc2bdf1660f5d3969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323874, "uuid": "ecb55254-d2ea-428f-9540-7158eac8df61", "comment": "Malware payload (Mirai)", "value": "7d2be8f027154f12108ac249e4f19ddb9ffda8e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323874, "uuid": "91a34d8b-ca9c-4439-967b-c65b84703adf", "comment": "Malware payload (Mirai)", "value": "862f3fc6db4b23a2766b758714107a859784eabc0624991048ae67930330250118a76506ec015aa98e1ee7ee139cdf7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323874, "uuid": "c0f58447-f0a4-4572-adf1-fde9814b4cb1", "value": "T1E0A33A82BC819A11C6C51777FA2F108D330267ADF2DE7263CD151F647B8A81F0E6BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323874, "uuid": "58438a12-35e6-4bf3-968f-0e3e986964ae", "value": "1536:4Nnc97o17akFF1HsPlbBjoS9tK7BVpPiv1bhYzJjR+J70q5dn2rwG6Uz3MI9i3Nh:V9s1DF7Hu1bIDpP61keYq5F2gzY/mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323874, "uuid": "1aa130a7-75d2-4613-89be-1bba9c61368d", "value": 99632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323874, "uuid": "431595d0-73a1-473f-8c80-5d54309cfffc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323874, "uuid": "80de7889-325a-4e58-bf09-e0fb13683ede", "value": "MMaaRRiiOisecTanee.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6c816a-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327406, "uuid": "8184682b-b1d1-4c20-aeac-f93585a026ec", "comment": "Malware payload", "value": "a7e22f7fe1fec2ec11f25968edc6dafc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327406, "uuid": "2c0a8cde-1537-4f65-a6e1-9a3faf7a2e7f", "comment": "Malware payload", "value": "d60b04ecea3adb58b4369d4e52121377a9bc28fa1a29b69ceee60144c47492a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327406, "uuid": "21c7f2e7-f358-4063-9d1e-90d3520f9081", "comment": "Malware payload", "value": "6b0a5b083f9380d99fd695e2eb86a91f7ec1ba4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327406, "uuid": "cbd6fd24-ad7d-42cc-a42a-eaf9f1ea4a82", "comment": "Malware payload", "value": "813a69fae0f1841bea4ca6a7107add79ea4dfecae5f46ba55565198656002b34bcaf5946ced0c52dd9abe96a59d5b528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327406, "uuid": "f1249e56-3c50-441e-af65-396c60e97c49", "value": "T1A5749E7722B404FBF2A150F6D89217D19F6EE8C1FA217A5ACF4021C56DA37B05D386E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327406, "uuid": "5ff3b17d-b0d1-475c-bb56-3e5e6af597e7", "value": "1bb9f9d2ee0ced9693baf2f68dc7a4aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327406, "uuid": "2db520ce-ea99-4d9d-a427-df4e85e0f3a4", "value": "6144:MGzxCIdjiQoztq3BCldwAxXgg/96MaBBmVwU87CVb63vZ3AK3OQqZeCXtdBhqR:FzViQohbldwMQg/AMaBiih/Z3AK38tds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327406, "uuid": "a33a6f21-1b06-4057-83d0-77bb93f433ab", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327406, "uuid": "8da581f0-ba36-4cf7-ad44-1fd1ce753141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327406, "uuid": "3d642cdf-4993-4e9a-a91a-a883a524899e", "value": "d60b04ecea3adb58b4369d4e52121377a9bc28fa1a29b69ceee60144c47492a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0d76a1-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352124, "uuid": "526a6c03-430e-4e0f-a3a0-8c567173e536", "comment": "Malware payload (Mirai)", "value": "b1dfcdb4231fc07e66db197e4f447500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352124, "uuid": "9168891a-53e2-49b5-84a2-8d4d90d8160c", "comment": "Malware payload (Mirai)", "value": "d614e03ba9ec3b8bc6b942b8e2f4743eab4d43b6620267a73896a11f5387c315", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352124, "uuid": "758fcb3b-0000-4611-bf1d-4e7e8e0d73b3", "comment": "Malware payload (Mirai)", "value": "f7fc674a207b525dfe2ae735c7add5bf7220b2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352124, "uuid": "8481b08b-8750-4a3b-9db9-cfe1c10aedf8", "comment": "Malware payload (Mirai)", "value": "501dcc85590bb97a7f9af3d9b45b079a41358431c6d326637aaabaa1c5b833e956989db6345516b92802949ae1e194da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352124, "uuid": "5577c04a-5789-48a9-8df2-0fd092a0e02a", "value": "T1FC043AD7F800CDBEF06BD37684530A067530B7E144526B377253796BED3A1A92923E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352124, "uuid": "959a73c3-03fb-4d45-8cca-f1c79ac04c9a", "value": "3072:jNaxp3o0IjzpZEX0D5hIQtp4SbVAjbiALmnI2N5qwrMxY7XyndmlX:pipNX0D5Gmp4SkLmIQQ8ynwlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352124, "uuid": "e86a7668-4e6c-45c8-b242-35637d461443", "value": 182400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352124, "uuid": "04fc970c-ceca-4a4d-b9ae-7a73a3ca05bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352124, "uuid": "f7385514-ed25-4601-b3d0-9a636ed89350", "value": "zero.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7f5eda-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324479, "uuid": "f9b6a2b1-da3c-4080-ad0d-b8cbf98f2457", "comment": "Malware payload", "value": "21a64d49a054513263645ab87787132d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324479, "uuid": "10863677-52f7-42c4-8d26-27fe41bdb9d6", "comment": "Malware payload", "value": "d6317db9baeb51e7c4e67db12190502c301747a63fa0aa734243ee4bb811233e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324479, "uuid": "47eba957-fab4-4523-8efb-9a4dca8b1294", "comment": "Malware payload", "value": "9e646592fd9ef210ff7e2b3feac7367aa4a49900", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324479, "uuid": "b7636c96-44d3-4ff4-8d03-5e6d9fcc0851", "comment": "Malware payload", "value": "5d83f4d9e8cb55365461649dd9286b3e03fd7ba83982d9b26d5c66700f126a7fc7194b9b542609e57fd81abeefc669bf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324479, "uuid": "503d4b7b-c5a9-427c-9119-4278a04f9d41", "value": "T13521083AD1299130D21BD670F5D1C1803306910ED816DAB25BEF52BA9B070CC228B270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324479, "uuid": "633fb467-9024-4887-9403-92c30c70494d", "value": "24:9kvc2mLibUbWVS5e6S8PGo0HjVaebffCPtTnUaYgmkkIMhrwUEQVAhcmnhsk2PJh:9kvc2zdI5bHUDVamCPtzU3gT0DiimhsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324479, "uuid": "f509c421-466c-4359-9687-3098ba31a4b6", "value": 1378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324479, "uuid": "2c295d63-11cb-49f6-ac9f-bfe0929f3da6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324479, "uuid": "b6f84705-a1a9-41fe-a345-38464d351cfe", "value": "photov_329525140467.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37a7505-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307336, "uuid": "472457b0-4125-418f-ac33-cc9c9c32e081", "comment": "Malware payload", "value": "8648de0fbe999504aa82da90394c363c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307336, "uuid": "f2f2bda2-8628-4be7-b444-209c2c5d3747", "comment": "Malware payload", "value": "d63f9471f0a4a38b64686cba7d3040e0930cdc9e5ce5e6f1f9d77739e0777acb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307336, "uuid": "7cbf50f5-ccfe-4a33-bce1-dce4b66f337f", "comment": "Malware payload", "value": "8b37fca60ddce74fd392f0c4a97fe57dc480059b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307336, "uuid": "5a3bc53d-c0da-4ce2-8a7a-43f772341d3b", "comment": "Malware payload", "value": "24f6437d00b6439aca23918c34f69ca152b8c51d6ca35e5d48905d3dda75c7fea834526216d0dc45b5b75bfa7e547731", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307336, "uuid": "5e173242-25c6-45a8-943e-e7363b9d87ac", "value": "T19C12D034943711A4DC5557BDBFE5125203AE8CB95143B39A644BE478743E488BF7AC34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307336, "uuid": "e594b5ef-3291-499c-92af-f58b9f9a27e4", "value": "192:1Eaa9Y7wGEad2IM0kQ7nSR5fD1h/iOm84pxy4nQ78nz7:17a9YlEadHMig5fDTipXz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307336, "uuid": "325c8a5b-964a-48d5-8a27-bb66bd49048a", "value": 9524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307336, "uuid": "40887449-26a5-4367-8612-db07ea9cea65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307336, "uuid": "051785d9-459a-4095-a231-454b5107d5a7", "value": "images_20260728_110200.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a056fe4-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785351478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351478, "uuid": "aa199f34-6b11-4270-8cf9-c2893a4b1f3f", "comment": "Malware payload (Phorpiex)", "value": "0ed62134ba816c2c604a319692d97201", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351478, "uuid": "d2347f17-0f1f-479a-ab05-489ee08636f0", "comment": "Malware payload (Phorpiex)", "value": "d664021eff6b92368479a4b9401272f9f869bddb0a22da5434747bb0433fff45", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351478, "uuid": "5f452bfe-1199-4ab7-abe3-710b963c11d2", "comment": "Malware payload (Phorpiex)", "value": "3efb191bcefc501c90369dfc7e67fe67683622c0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351478, "uuid": "0d9495bf-6ca8-4548-be45-4e8d7cffe05c", "comment": "Malware payload (Phorpiex)", "value": "b9f69e06d762ae43a1612fda8270c2d393d7d1d02fd22d4485d0b6f913bf6ea730767279d6ec1561e118551defab9222", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351478, "uuid": "e8e4cac8-76c3-43ef-bc65-c7e0813203d5", "value": "T15E621B0EAA818035EAD10076827F462749BE6C7223D4B9DBF7A068CA5EB47D1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351478, "uuid": "30e08929-fe34-4420-a814-6dd1841873e6", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351478, "uuid": "b570a547-bbfa-4154-b6f2-b3263551ea76", "value": "192:xX7wkiyXgzhDDAyxdq4lKQe33hg/FeaFResJKUSfTzwbkQaesmJxTmv8U9cthKfz:xZi3DAybqFBg/Uf9TmkQzFav8U9cul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351478, "uuid": "80e191bf-fb17-42fa-b960-67ebc6e0f6c4", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351478, "uuid": "d6228e72-87b4-47f3-9942-56afcceb303b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351478, "uuid": "df041f65-e7cb-49f6-94f8-8e853e796dad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4344b948-8b84-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785353560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353560, "uuid": "66ec9069-a9fe-4072-bbb8-dbc30cc4de6b", "comment": "Malware payload", "value": "cb54f4b533db5588503feccc7e917842", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353560, "uuid": "7b5a9a8a-dfc1-41a3-834f-44539c3e764f", "comment": "Malware payload", "value": "d6a3c1e20b5ee7b111614d914b286bc1d0d4bfd5f6663893a4478ab28c6c2e58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353560, "uuid": "2aa60e03-8a1c-404f-b7a8-93af8a1947d7", "comment": "Malware payload", "value": "bb60717d92493306ddd976b261c0dc4d0448019f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785353560, "uuid": "f250bb03-95b0-4ecd-9fec-3311577f1a03", "comment": "Malware payload", "value": "b96b514f534c43db62f8a63d00a193a4371d353ae421e1d94366ea505292b0e9e9fa10ff5b3fe345b904f701bcc8a7f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353560, "uuid": "8ec6ef63-173a-4445-9490-c1475c67fe62", "value": "T143E3AFA7F74F1450C82107F41BCB5BAD2A3325018E6B56E66C2E773E6A739DB18063D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353560, "uuid": "9ff84334-bf78-4d44-b865-b74fd17fbd4d", "value": "3072:rmO09bfVP2weXXGABBx2n+vNn9njgYCSfZDIGdq:rmO0tdLeXTBT2S9nRCSBDZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785353560, "uuid": "8b0bec09-4e8c-4a00-b592-cebdf106a70c", "value": 148952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785353560, "uuid": "03706e3e-f49c-4ba8-8ac3-3998a47fb9f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785353560, "uuid": "a533fa61-d7e8-469e-99f8-968915933502", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa296b7-8b8f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785358351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358351, "uuid": "41efbf71-1527-463d-9b46-160db536864d", "comment": "Malware payload", "value": "5b4e700f64175b020cf150e7e9586517", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358351, "uuid": "fe7c6da8-1601-4cd7-883d-1069290cb2b4", "comment": "Malware payload", "value": "d7676d0f24364b278a6dd2b1c5fd34f688881cf3ff9e53e1e40f1b4048b7ce28", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358351, "uuid": "127981b4-130c-4918-89ef-b8fa4b3c8cdb", "comment": "Malware payload", "value": "a70da5f794a7c7775e0ee155ad07685da8114a09", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358351, "uuid": "07908dda-4038-44fe-a39f-012bdb96558c", "comment": "Malware payload", "value": "b6980231225408c311b003534978cce368ae1bda29b0eb8fee794146da93efb2caf40fe8cda02f8deeb3f36739fd048e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358351, "uuid": "3ddd00fa-d4ed-4bcd-9296-2f8f32f494bc", "value": "T1F7E633085AD093EFEAB7913CE9E255D6E669B0B36B31C4CF02D483151D271E0C93DA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358351, "uuid": "2f0cddd4-3b2b-42c5-9d5b-63d579517cf0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358351, "uuid": "c6562701-0883-443e-a6cb-c4cbcb4c819f", "value": "393216:vjRwlUDJrKxNSeYhBkFZKXMCHWUjX0cuI3/PGTAI:vmlUlr6SesBkFoXMb8XhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358351, "uuid": "7f48b5cb-f763-4919-a2a2-4e3fff985dc0", "value": 14285673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358351, "uuid": "e6678452-4c03-4392-a6e9-cb250313e8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358351, "uuid": "42c699b5-0787-47e5-9bfe-eb4372675306", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d63d0d5-8b46-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785326948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326948, "uuid": "759503a1-4f9c-4937-bb40-6516bd64061a", "comment": "Malware payload", "value": "6d5c0faf123c2bed75ef86f0432aebc8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326948, "uuid": "102d4660-be66-4f9f-85ec-4703bf21a216", "comment": "Malware payload", "value": "d780f1e6c3778505ef4f160043014e1aa9ecf994c9cfc78d87a3e588b08fbb32", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326948, "uuid": "6a56c6cf-5cf8-4784-90ea-7982630e9b5b", "comment": "Malware payload", "value": "5736c9595f6454a0cd67ee98d4c0f0d5658e4e48", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326948, "uuid": "036dfe5b-78f0-415f-b328-d198bd1d6c96", "comment": "Malware payload", "value": "6dcb46f3ddb30de38394ff802f789b73c2f52003372185be3ac4de57f9579cb7ce85809b0dc310e12cb8837b10f39dcc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326948, "uuid": "37e916d0-0d2f-4180-aa13-49d29877f606", "value": "T14634126DC78F06A4CB4667B7521B9E4805FDB33EB30A50B275AC937137AD82D04A54BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326948, "uuid": "2fa878a7-843e-425d-8fbf-8a02eabe52ce", "value": "768:hU2sghQadpUbfYgAcsZ85FJSPSJ3Drf76I2:hUkpUbwgAoPSWzj761", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785326948, "uuid": "2335ac41-4b56-46b5-9e4a-a36258afe03a", "value": 252007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785326948, "uuid": "93c8bc8d-709a-48bf-9e5d-e1ba6930e3ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326948, "uuid": "d4d2f92e-3ba8-4c0a-a8d5-ee181db27053", "value": "ORDER_INQUIRY.rtf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e865fa-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324417, "uuid": "2ae9ab22-fcb7-46c8-9ab7-777af96f36ba", "comment": "Malware payload", "value": "78c3d1228eda5325858c25b729133672", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324417, "uuid": "839a1a65-eea6-4949-bb63-8e02c4759541", "comment": "Malware payload", "value": "d7c3b3e9ee4cfc3cac71ee8cd92309e4115360af5f7e155aa0d67e13a367713a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324417, "uuid": "93553eb9-61e4-4bef-81df-1656d6d79c64", "comment": "Malware payload", "value": "04c41f63325c10fdbaacaf1b96da35f0db098f78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324417, "uuid": "1ab6c257-9096-43b4-b5ed-12cf5947cf7d", "comment": "Malware payload", "value": "d70436fe6a522b5347b3514833d6b73a46a55806de8119ab588497949dc17bd72815ff9e99d8e94b25bc541ca2ee766a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324417, "uuid": "6958336f-656a-46ee-9493-b137dee56304", "value": "T1E421E94E5006B20ADFAFA23619D5564E3CED05A19B5EFAC247723EF2F4892980A40112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324417, "uuid": "37820683-e396-40b4-aa2a-fd1cbbd68695", "value": "24:95yDBbYC64nVDcIBfuj/6W3jB9lKbwQxEwmHumkk0XMhNmW8xwu0r52acwfI:95tCD1cIBfujn9UbswmOTkPNDuwT5Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324417, "uuid": "0d0ca829-a3d6-4fc5-ba8d-1c3d452b1f29", "value": 1438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324417, "uuid": "8831846e-6ef8-4d23-a236-21629c2248c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324417, "uuid": "c879106a-5fe4-401e-89bb-f3a924234dc0", "value": "photov_953091616750.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa10420e-8b59-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785335398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335398, "uuid": "8d89bb63-a795-4c9e-af8f-8f4f56d579a7", "comment": "Malware payload (ConnectWise)", "value": "98d8b9bb62d412dcb2914f919e4750c3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335398, "uuid": "69ed2caa-fc18-4d85-be8a-e47213da2941", "comment": "Malware payload (ConnectWise)", "value": "d8a5b845155fb8b7c1e6f584c1632049071ea72a8b64748e54d9e7a9802af31f", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335398, "uuid": "0bda529f-ab79-4817-a82f-4b76e7d75220", "comment": "Malware payload (ConnectWise)", "value": "bc39c0be002305e29119785480bdfb529ad376a4", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335398, "uuid": "19b60d39-f0a3-4df6-be1b-8523b7d375ff", "comment": "Malware payload (ConnectWise)", "value": "a77ff27351d88b480d0b0a8cc33062f7b8fc93fa317dc17e07387ff3976c2020b04f899e5204ebba41f2556a4174a828", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335398, "uuid": "879e3621-6324-4d22-8cf7-122e26a923b9", "value": "T1D6646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335398, "uuid": "fc8069bd-590f-49b7-a5e6-4c7b07cbc06c", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335398, "uuid": "d2207659-fcb4-4ed8-8008-43feb99422f4", "value": "6144:imlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:h1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335398, "uuid": "e2988515-703f-4020-8de4-5ad0615ba362", "value": 312560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335398, "uuid": "12030e98-177c-4589-82dc-444228b5d8f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335398, "uuid": "951a6ca6-5fc9-45e2-983b-8bcdee31b59c", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db1beee0-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324609, "uuid": "60b8d755-7065-47dc-932a-d1f510345387", "comment": "Malware payload", "value": "014590863899cd939794f0d696a70a80", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324609, "uuid": "dc7d9f74-795c-4428-9de2-b9d70ba13d14", "comment": "Malware payload", "value": "d9d1e5ea108414535c5c8d6c7ecc30589fee71ff48cd19f1049d60b52b0a26ce", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324609, "uuid": "cf232ec0-09dc-4377-af1a-00619d7c3de1", "comment": "Malware payload", "value": "1ca9dc1bb7f77c41a340477b8a6ccb42487bfbf4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324609, "uuid": "b83e7865-8ab3-4554-8f8c-ceb5acbedb61", "comment": "Malware payload", "value": "f961fffa4c8933ab332fa3bea9c5dd7f82dda397ecec031fe1720635dda77f25eb2ca80cc17af0d8e1974dde91f99da5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324609, "uuid": "53357589-9888-4c73-8e06-529be07dc221", "value": "T18831C9D1E34EE350F3D7C07F773D6BCC387825691544766DBEBA61486883818D251D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324609, "uuid": "abeec81e-cef7-4970-81b0-5e074ccdf867", "value": "24:9yNV5CywRh4vqLtw8tt+zvY/AFsqRQlG4uttNVJubQ4H3ekmkLAxTW0Ds934Y8N8:9UGOwt76jYJURfJqTLmvst7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324609, "uuid": "4199af40-9df1-4d0b-b201-818d4ae6f958", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324609, "uuid": "2e962734-c152-49d9-b585-c4120a47a0dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324609, "uuid": "126d8d39-fe7d-42a0-bda5-62c0d513bc9a", "value": "photov_319873801004.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b443cac-8b46-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785326945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326945, "uuid": "605d4645-e6ea-473c-a125-e4decfaaa9d6", "comment": "Malware payload", "value": "78070cedab4fcff6fc4dcfb098232299", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326945, "uuid": "9457473f-26c8-42c8-9ff6-f83a30e9a91b", "comment": "Malware payload", "value": "dae0629751f92261c4f365b4fc7fddbb86635adb89a6db7726cf7b6f62f991dd", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326945, "uuid": "bc61073f-fa38-4116-905a-4f1cf221249a", "comment": "Malware payload", "value": "1430ae998a87088d557ebf83338efbbf5be9591c", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785326945, "uuid": "e33e4045-650d-4709-9a3e-71e2d744e914", "comment": "Malware payload", "value": "46947ba0ceac58b7bc45ece7eb9c6d0120d42f2a763e65497bb8fccc30ef35bad02ae7fe9140677d715156e609018713", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326945, "uuid": "f0dfbdc0-3814-490c-9240-fed2c9455e2c", "value": "T1CD04108FCBAD86E8D119A4BB5CE1404C8CF96F37F4054CB8B8BCA0863B6C10D16785B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326945, "uuid": "c51e8a29-fb40-4f1b-be50-582251e123ae", "value": "384:Y6Jg3X2ta1gsdctxXgv8hMhtBOjqRqrWBwLfvs+MZnVJIVLAVIsPKmBkRGZIg:lm28gZxQTnBO+RhwLvs+MZnKWi3kIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785326945, "uuid": "aacaa6c9-d22e-4f67-9bce-69ac1cedfbf1", "value": 190022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785326945, "uuid": "8d46861d-610a-44b0-93a8-1fa4e7d35403", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785326945, "uuid": "67266cad-f82c-4bc2-9d9d-c248de65f4d5", "value": "ORDERXINQUIRY.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6209427d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324406, "uuid": "f24cfa22-e7a6-4c51-b7cf-3f6d3d62f256", "comment": "Malware payload", "value": "30d62166c49f6bb3a95707c4b9a2baaa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324406, "uuid": "3db9f016-1678-488c-bc94-0ea85ae8e578", "comment": "Malware payload", "value": "db224ca8fdb353dd9914ff91283b022e30adb75c33a750ed7bde0468f7991fcb", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324406, "uuid": "ca89a22d-acde-47cf-b46e-3f5f446574d5", "comment": "Malware payload", "value": "b28234e95ff7f864fb9bf7638a5eccbfb2e3fbbb", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324406, "uuid": "5395c8b4-3665-44cb-b2c0-e5de4359d274", "comment": "Malware payload", "value": "11cc184988796838e4fb0b9335f12c6b80938304e4f135a92002cfa818055e62ea19ef705279ccbd086c401ef102d6eb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324406, "uuid": "3a01a283-5a94-46e0-b1c9-348f0b9e8422", "value": "T1F821C87CA089AAD9E3CBD1362CFF1B85B5434C10A8440E62F21BA7453B27BC0553B99D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324406, "uuid": "f5935e4b-95e0-48da-a796-67323867ad5e", "value": "24:9hPiwzZNfbBlyGsZ/a/04RP1ij4rXZwUmkjFWtubjeYRK9AR2zU:9RiwnDBQGsc7XvNwUTRWIb1K6R3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324406, "uuid": "5c139960-f696-489d-b195-bc06fad0d60d", "value": 1343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324406, "uuid": "3f29e380-83f4-4433-8520-d5bfb7345766", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324406, "uuid": "7d5e06e4-838f-49d9-b63e-f0fbf551a3ee", "value": "photov_748111917028.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94847a5-8b13-11f1-bd95-42010a9c0009", "comment": "Malware payload (Copybara)", "timestamp": 1785305225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305225, "uuid": "af4fffbb-97e3-4bbb-b89b-4ccfbaf6f572", "comment": "Malware payload (Copybara)", "value": "c95cd77f0a88b3f74a794d735f547e3b", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305225, "uuid": "55ba8e9e-cf75-4242-8ae0-057fb968c0c9", "comment": "Malware payload (Copybara)", "value": "db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305225, "uuid": "74b58eef-bda4-4c30-af06-fb45896d6c36", "comment": "Malware payload (Copybara)", "value": "216414ab01a1fee5a056c3fb2fc167744002d5e6", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305225, "uuid": "38877727-e0c1-4be9-ac3c-6ba00e698220", "comment": "Malware payload (Copybara)", "value": "4f0683848c5fe4678fc11ad50743dfa66e6e44c2f3f552906f027206d09fb2d9069d0a14397a6b2de3e55ffc24871b7b", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Copybara", "colour": "#AB0D89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305225, "uuid": "e1f636a8-5d17-4707-bbeb-c447371160d5", "value": "T18DA63382B3495F5AD9636E318D61925841322D1CCFA399177646B33C38FEED18F12FA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305225, "uuid": "251099d0-eef0-48f2-8656-d12d47fdffcf", "value": "196608:OjnYBnjbs1wWwPLCLH+QN4ut1eMS4pOvoQ8Y5QrlHDazK8zlv3FKzre3hmggk:ljo1xwPmLH+luHeF4pOvH8Y5Qrxa7JPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305225, "uuid": "bb1500b8-2d07-462a-a57c-9903901cbea0", "value": 10029886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305225, "uuid": "d7f5c0bc-cf87-4dca-ba93-ef0f100164ca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305225, "uuid": "d2c055e6-0442-48b5-8c93-4c985f45d82a", "value": "db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af2a2c2f-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324535, "uuid": "57b05795-ecef-4b79-bf0c-c645de5f06e5", "comment": "Malware payload", "value": "e768f88d8f6b01f5c80003fac64a34f3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324535, "uuid": "36006862-50b7-42bf-b3fd-0a24f3aec394", "comment": "Malware payload", "value": "db692efe262d1cff65404d339854a925aa7e0ab2a8f2d4ada56ca6956278362b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324535, "uuid": "ad3f6706-721a-4835-89b1-19a5878f1eec", "comment": "Malware payload", "value": "e42da40d5803f0ee189a965a4d98f4b07c6e5fd2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324535, "uuid": "b7b6a9ab-85a8-49e6-a2a6-46f81e2ed52f", "comment": "Malware payload", "value": "58ad82c739fd5b0b788fac79922b960d76096f7c4bda1d4354407530891d3f6c6baf22c05996b55c2ccdc7ac69a56cf8", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324535, "uuid": "c83ff6d7-9bf4-4f8b-91ab-6757f8385135", "value": "T18F21D864134952F7CD11D1B4AD44A16A1130AA5E0CCED6A279A2216BBC1BB4E6B29D88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324535, "uuid": "24717b5a-a903-44b6-9d25-c19bb155acf9", "value": "24:9JIVz+guM2e0TGJg+wIpiUdRCjBJ7wCemk+A4P/OINo6y3glN0m:9JIkgSygEpit8T+3Zo6y3gYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324535, "uuid": "213de753-e495-4170-ba2d-80225d1b08f4", "value": 1428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324535, "uuid": "55445165-97ce-4cb1-a9b4-f4f076de7b3b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324535, "uuid": "b0d1d4b3-ae1b-481b-99f8-03a3f67f992e", "value": "photov_401530842369.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bbcedc-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323875, "uuid": "7d5efea4-08b4-4891-95e2-435283a865d2", "comment": "Malware payload (Mirai)", "value": "e86ae3b6d3ec1829b6c8b139b4dedfc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323875, "uuid": "39df1adf-479f-4fa1-8ca5-74e88e434010", "comment": "Malware payload (Mirai)", "value": "dc26c4aa0b5dd2cb74609168a68c818be6b9c3821fa56a5a9f659a5ff319a628", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323875, "uuid": "4556bbce-f909-4738-8a92-31158df4359a", "comment": "Malware payload (Mirai)", "value": "977fc204f36144a0d2d2aaf10620bd2bba2d68dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323875, "uuid": "eb484f00-ff99-4bee-b7a1-f6097e89d00c", "comment": "Malware payload (Mirai)", "value": "b5b3e115baed03395bde3d24c36d865b8962fc88a35df6a50be9f369b9a9df28f099df9db0943bac66adcae996907604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323875, "uuid": "a0739457-caca-45d3-870b-ec65cc674c0b", "value": "T16D733AC9B5C3F8F4EC040A392176EF319E77E13BA129DDCBE7D96623A941342941229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323875, "uuid": "6d906baa-b463-4562-b93c-e28f5f420861", "value": "1536:9QC/3umbutmUl9i1WIo27ozS9Lo/b2+gJymeMlitPWmM18HR5D4WjwZZbq+qVr5v:9Qu3umbutmUl9lIlkeJoT2hJymeMlitp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323875, "uuid": "1435fbc5-1916-4c91-b64a-a4bcd0273f43", "value": 79600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323875, "uuid": "36bc20d3-51d3-492b-bae4-85694a71b443", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323875, "uuid": "2f9cba20-8d1d-4f4a-aad7-d771304d86fb", "value": "MMaaRRiiOisecTanee.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9529b444-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785358851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358851, "uuid": "b9b7c318-1ecc-4076-97b6-c856fab1d49a", "comment": "Malware payload (Mirai)", "value": "7ad1f7c974926a2f1a78b56da3d2b49f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358851, "uuid": "7b09383c-5c95-4280-91e9-75cfaace99fb", "comment": "Malware payload (Mirai)", "value": "dc923b4f2165fe6f326f26f8739ceb3d3aea3e5b78bc8b091047fc677d0214ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358851, "uuid": "3f458f39-682d-4313-a0e5-3828b31650bc", "comment": "Malware payload (Mirai)", "value": "ef5c8b05125cef8ed901f43f20838f6f638add82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358851, "uuid": "4302f553-13e7-40dd-97d4-b7a026f3edd8", "comment": "Malware payload (Mirai)", "value": "607ff034a072d21e2bad291c017b2604f87c7f62f06eb17850dfeb1ddb9c2326b80cc3b2e6aff362b83b09897c3b75f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358851, "uuid": "6485fd17-0ad8-43c5-b5a2-62a75d2b2d81", "value": "T10AA3C71B2F619FACF3A9833497B74B30965C23D123E2C684D1ACD9012E7434E595F7AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358851, "uuid": "48671086-a45a-4a20-838b-9abea057b79b", "value": "1536:dQ8ZkBcaCn7FuLyEQEbJv/1iHGdgW8x7Q8puFs7dXav09TV3iDtR:b37FuWEQ+JX1VdgHbuFsBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358851, "uuid": "dbb0d7d6-71ab-4619-9209-0489794c843e", "value": 98300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358851, "uuid": "7fdd40cb-22b5-4877-a485-deca621b1cce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358851, "uuid": "22fa3dd0-85db-42de-9159-488b002ade89", "value": "ya4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b9db05-8b4e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785330561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330561, "uuid": "43b22025-543b-4fd7-b500-6046cc97e9fa", "comment": "Malware payload (Mirai)", "value": "b47211f34f8612732d1ed8b4700a95a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330561, "uuid": "007f5a2d-b667-4508-8720-c6c4c30d45d4", "comment": "Malware payload (Mirai)", "value": "dc9d9cbe82984f1c897f5d7c185fe75d35c63e44615bf9db9e0a53c7786a43d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330561, "uuid": "6b3b1e8f-51b8-4b12-b11b-1883cef5b272", "comment": "Malware payload (Mirai)", "value": "32ffa40cdf859ae31cdd72815e150ff4e389b682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785330561, "uuid": "fcfc7f4d-4ed8-4114-87e1-b52758becae8", "comment": "Malware payload (Mirai)", "value": "2acabd1651592c12ddcb188b152ad65ec2ad2c9cd3ee1b9518010a0e3abd82f315be0542e42bcc69f8d6bf4ddf97d2a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330561, "uuid": "f96399c7-5286-43d0-a61b-88a30f1e462e", "value": "T1CCF32945FC419B17C6C612BBFB6E428D372A17A8D3EE72039D215F24378A85B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330561, "uuid": "28e80ba5-95f1-4685-a218-74a11347c9c1", "value": "3072:tvFn5w0Wed1h4WKLucUNsXPi5d+LrnZH:tvEozh4WJc2sXq7+LzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785330561, "uuid": "3d51532f-38f7-45d3-8860-7a92b04cc749", "value": 169600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785330561, "uuid": "113ce77c-9ff7-494b-a01e-8e9bf9d884aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785330561, "uuid": "cbd7efea-b6f6-4e31-9f86-f49dff4d604f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce2493f-8b7a-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785349174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349174, "uuid": "30989061-9130-4435-8984-ee9dbef0cc5c", "comment": "Malware payload (SalatStealer)", "value": "824a0ef05857141f251523a56b979b1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349174, "uuid": "1de3db1d-2116-41a9-80c1-20301163b4fc", "comment": "Malware payload (SalatStealer)", "value": "dcac68a58f09eec59bce587a86d91ea1570919edc8100715ed83bcb1a0fea364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349174, "uuid": "24ecc49b-6e2f-4fbc-8af5-10e91d5ea233", "comment": "Malware payload (SalatStealer)", "value": "9d1b68e159ab961fbc2a698065d090afac7450dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349174, "uuid": "6bfbbb4a-5e40-44b6-9320-73eb32a5a8b1", "comment": "Malware payload (SalatStealer)", "value": "cfe5b4a30aa403e1cacbb3696e639844f36ca6529f5eda91a89a42ff751a0ff08aeb477e747695d02c90b671da5b9ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "salat", "colour": "#6DA083", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349174, "uuid": "ab840fa4-ebb5-495e-8fe1-de4c6a6fff27", "value": "T114F533A4D80B961EC2D25CBCB6F850F4BAFC58E18F70551EB4106D0DD0A606EF53BA8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349174, "uuid": "60e43fc1-0fb1-4464-a50a-dc963301b037", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349174, "uuid": "9878c252-c3a4-4670-8034-ff1ffb6afd31", "value": "49152:uuz+6sGu4lwcWs4k9BxW+v5QPhFzdhcIuN5awP/Q57WvIDmQqNlUDc535FQR3ESJ:uEGU9Bf5+hjc35GpWPQolUwx5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349174, "uuid": "7c7e0d99-18e5-403a-9fb4-3faf7d4a9a5c", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349174, "uuid": "b158f7a6-55e0-40c6-8639-1f759900c4c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349174, "uuid": "c6b7fdb5-77d8-462c-960f-57765bc2b73e", "value": "winwsdriver.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45bd68d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324625, "uuid": "4c5f4c53-62eb-4140-85bf-b2a59d669305", "comment": "Malware payload", "value": "2832ce5aad9cb13c88c777457e2ee056", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324625, "uuid": "7c91161d-731e-47ac-9982-0d9e92027dca", "comment": "Malware payload", "value": "dcc58cc3d0ab2f4c441e84c10e5fab7a65b4a679281aba18681fbd312b32f1b0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324625, "uuid": "d0e345e7-1ef6-4cb1-a10e-d930b3871004", "comment": "Malware payload", "value": "74c14dfcc37fdb9f1f6f1a75ea6034e9c3b44173", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324625, "uuid": "62d82ac0-928a-4300-94c3-5e831072eb08", "comment": "Malware payload", "value": "80d249637d50bad0fbd74d3136e2666d28d28e9cc30f3f235c281ca3ea5d4db88075e4f28be9a673361ee1be1472cda6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324625, "uuid": "b9d4eebe-679e-419a-86d4-aad7156f68ee", "value": "T1672186409AD4D230DD27F7313E54A7D729B1A33D2085625615CD7391BB879B21700FB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324625, "uuid": "e9f1e052-c346-44ba-822e-79a72cd603fc", "value": "24:94vuyP0Wxo1G9SwHJ3KADyOYF6/3B1KDBArmkm+UaNuUamlhJO5y1SuX:90uyP6c8wHwA2OYF6/x0GrTm+UkOEhJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324625, "uuid": "202c7169-8834-4747-8911-f85a4c287a57", "value": 1379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324625, "uuid": "25358652-acf0-4b78-a201-d1c21a476ff4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324625, "uuid": "fdf8d28d-f1ef-4aea-b73b-01321983faf7", "value": "photov_432311984716.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81607194-8b1f-11f1-bd95-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1785310285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310285, "uuid": "80eb02db-7457-468b-87da-53970de629fe", "comment": "Malware payload (SilentNet)", "value": "04b50ef76d674a69c3a13025bb23b504", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310285, "uuid": "58e22b64-d2dd-4bbc-aa32-2c32bb8ad278", "comment": "Malware payload (SilentNet)", "value": "dd04bef1fb8fc82681dd90e39b6593c6a7d7afe8a6ce7739bc6f2bbefd763bd9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310285, "uuid": "74cda8a3-6ad5-452b-b250-f214a87d9790", "comment": "Malware payload (SilentNet)", "value": "83f13a37abf0a4afb100fa26eb7e65d9613252de", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310285, "uuid": "7d887ed4-7437-4b0e-a258-57bee3bd4334", "comment": "Malware payload (SilentNet)", "value": "547bbfc1b44c1871f2c0c92af68ad9595aba2f0ef601aa2dd308ff176f954238a4d8779acc526d057a0213da3b948c18", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310285, "uuid": "3f5b61ca-34e6-4aa0-b47d-3759d769575a", "value": "T1A8463320D9BD267DD0632330D4860E2B7B5E23C4AD056E2F5FB418BA0D476C66FC6B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310285, "uuid": "ced39e46-d68a-4311-b251-6828ec0ad45c", "value": "98304:2SQX66vQGWc8IQYrc16j5E0iG6oEiUyutka0fyLmm800Dx+KyksqYGB:u6MQ/+QR16j5E0bjDkUG80S8KMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310285, "uuid": "30a99ca8-011c-4d17-acdb-aa8bfe908c1f", "value": 5641863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310285, "uuid": "5d18f5d3-9305-4de0-bf2d-fa582ba4ce97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310285, "uuid": "b5cea46f-acf3-4c3f-b0e2-2844b6480474", "value": "KryptonPlus-CRACK.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d12a528-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307164, "uuid": "c1b150ad-7e32-4e9c-9b9b-c72e03de920d", "comment": "Malware payload", "value": "c376c69c115781ee42b226fe27a76383", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307164, "uuid": "997ae11b-854c-4b27-8c25-d2ad950596fe", "comment": "Malware payload", "value": "dd72a0c3cc63e92ecd8b7c06da9fd3decfec0eed569266bb843b9b728b45ab18", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307164, "uuid": "34dfca1c-8fb9-466e-9919-38cf722b9dc7", "comment": "Malware payload", "value": "0992d5a76d4610e789bd4f9388f533d5079a7cf4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307164, "uuid": "6e497366-da14-4f6f-a71a-510eee1a3ef7", "comment": "Malware payload", "value": "22ca2c0081150d44d71dc403e0d1078e006a0c7361a1fe946b86d759c42430016bf8663ec9b36f8585d7f4635bbd9550", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307164, "uuid": "eb11c04a-ca85-47cd-a8e3-938ed6d36d09", "value": "T14172B0E14B8A8A44DE93A2F77175E58903BB47D7C115521C1A9013FF5024DF709A37B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307164, "uuid": "87b82afc-5811-4c7c-8147-75679a13565d", "value": "192:s86DTcMwFxV36kzGBMndovlvwTwOfb6vjoZ1zvWBlBGrKjd3N+EJ8TnKInUEW0Js:RU8ztWvwTwOfsGhulGWSnRRJqR2vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307164, "uuid": "7cbf51d6-f5d5-45f3-86a6-75e21b7c39b0", "value": 16903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307164, "uuid": "e63cfdfe-e4c8-4adb-8585-65fbd9f3eee8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307164, "uuid": "1d568502-8422-4109-84af-9bc0827ed7a5", "value": "images_20260728_200830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd04fb2b-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785352905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352905, "uuid": "acdb8ebe-58c4-4e04-a70d-02d68615459d", "comment": "Malware payload (Mirai)", "value": "addddd198dd0a396b85c6cb91caf64a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352905, "uuid": "9ab2c7ba-9978-4e3c-b708-1393e6dfb077", "comment": "Malware payload (Mirai)", "value": "ddfc434ed42759bb027f8aa7ba857e1955a462000d7f128b8f2987995864e4eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352905, "uuid": "0e5a106e-44d1-4ea8-9f80-173296416f6c", "comment": "Malware payload (Mirai)", "value": "5820f36c43394c42807045dce087fd68cd72ec75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352905, "uuid": "3a1c49ab-872f-41af-8ece-1c1d3f8d5af7", "comment": "Malware payload (Mirai)", "value": "ce9ee6f1a3dc13eee5cea01dca6a52f60746273d060bf6f5618cf237076c12cd74998c15c7c0ce658a9e885ef1e618fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352905, "uuid": "ca555b46-e2c0-4abd-b37a-23a02fd5ed06", "value": "T1D0E35B17B5C190FEC8D9D1B88BEAF626DA33B4291134721E27C86F2B2E4DE205F5D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352905, "uuid": "8eb22d5d-5bae-49c2-830e-9b01af69720a", "value": "3072:qm73/ShoBu/N99181+A1vlzkYsmEq3jQELBKwlua4TEM:QiF1zrfJX4nTEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352905, "uuid": "043f36e5-8652-4dc2-bf2c-5096550ad0f6", "value": 145736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352905, "uuid": "54824d59-4be5-4356-ad5b-c8701d4da085", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352905, "uuid": "1177680c-e48f-4d51-8f39-8882b66ba3a6", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964ebc64-8b76-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785347686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347686, "uuid": "78fe368b-1542-48d8-b798-454a64e649ae", "comment": "Malware payload (Mirai)", "value": "4a3aa8745abb9f1922b71c38681b6f9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347686, "uuid": "e3bb61aa-7f7b-4eaa-9bdd-b9861020f64a", "comment": "Malware payload (Mirai)", "value": "de009520d1e656a090b96736712653fd174d629f0dbe7bbe0d240dfd18004d4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347686, "uuid": "8d8c80a3-cb27-4674-8ab7-6658efe47edc", "comment": "Malware payload (Mirai)", "value": "873006d3eb9479fb4b398f59f99b1a7e4ba9f44f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785347686, "uuid": "6c8cc3c4-1e32-41ee-96c5-6570aa26095b", "comment": "Malware payload (Mirai)", "value": "63cf59816ff6efcabe1132708c8438000699a809588ca4594ff3a26fe3f1f92bfd77051ce1f2b28504ac3b36a815d801", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347686, "uuid": "407a2155-7c5c-4183-b449-90082d281336", "value": "T117E39E9BBA4B0090C05702F0078F4BDE6E5762865FBFC6E27D68B537083D1DB5516BA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347686, "uuid": "bce9ff90-78b2-4cfa-81ac-ddf0a7285214", "value": "1536:eqdmlsYfDj7Zd+g/nCEtemAFNQhbkargRda10vJHtJdO/LWLL:eElYfLZd+g/nfYmAFUbkargR0aOqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785347686, "uuid": "7dae1347-502f-4496-aa64-52bab48c0623", "value": 150196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785347686, "uuid": "d18eca75-8365-451b-a179-1f21b4e37c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785347686, "uuid": "261f96ad-26d4-411a-8a34-a51212021266", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32c28ee-8b5e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785337454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337454, "uuid": "bf361df0-0740-4fc3-8388-6fbdc967ea73", "comment": "Malware payload (Stealc)", "value": "729f1552e401d7881dcf8b895a48565a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337454, "uuid": "4466bf9b-9bbf-4789-b055-adae474b2ebf", "comment": "Malware payload (Stealc)", "value": "de5b161afabe16c6de6a329454fb6bc2503a016431881e1a152b1ab755afc447", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337454, "uuid": "5868fb11-7a1d-4016-9f17-546f0fa5294c", "comment": "Malware payload (Stealc)", "value": "286571a57452fa00ee04300ab4f07fa82a62834e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785337454, "uuid": "0ab4d00d-d693-46b5-a754-688bc683bc3d", "comment": "Malware payload (Stealc)", "value": "f0866468bd02ebcba3e469947236cd83a3f2fb118b0220493ff9e6df45dba6db1b76319b64ff28ed79d05a4b1f5080b0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PPMIX0.file", "colour": "#91D417", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337454, "uuid": "9802b756-82ab-448b-9768-41be61b6c247", "value": "T1CB058D1AF3A502F9D17BC178C9424552EB72B8565330AADF03E14A6A1F376E05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337454, "uuid": "17766f37-f0e7-4db0-a163-5e1844a9a2d2", "value": "e9dd64dcce15e249bad873d9dec07f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337454, "uuid": "987436ad-5f4d-453e-8dd9-5cc6122e8057", "value": "12288:ZngwZs/X8eipbJVfMxBkfCTE+HCTpTkyxBlDetAqxSvoD:ZgwaMeipbfCkKTEGmp4yb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785337454, "uuid": "f0e89d88-7f20-4e62-8c41-75e5504be413", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785337454, "uuid": "2dcd0cf4-6fe6-4e9f-af79-7e50c62ba45b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785337454, "uuid": "10886a4e-befc-4e68-a4a7-4ffa514a97cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8713bf0-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324578, "uuid": "ec52b774-e9c8-418c-a793-407b47b0b155", "comment": "Malware payload", "value": "a7c07eb06caee53f38f9a8fad22c8f8c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324578, "uuid": "e4410980-de3c-413e-ab49-796692a2dc8e", "comment": "Malware payload", "value": "dfc8cd0674a378ded4d6de7feaed43f81d880b8ba6e13b3f9114ad4a052f56ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324578, "uuid": "bf7b4553-b16d-4eb0-a093-11e758585f2c", "comment": "Malware payload", "value": "2965f7686616ca64c445873d84305f9661fce845", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324578, "uuid": "a570cd1d-58e5-48f3-99bd-eeb10c0b6385", "comment": "Malware payload", "value": "f1e96be7334249e3b49dd8d978aaaf6b4511e326bf8af36a645403fec0135fd6077dad8600a98f43131f79351760cc17", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324578, "uuid": "06e2f7eb-9f63-4728-b2ca-d86c589704eb", "value": "T15F21C8C0007FAF94C8629B367C162D349E96DD4D936EC3071FF471E49612ACADB02AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324578, "uuid": "a39b9406-358b-4446-b6c8-2b9d37081f7a", "value": "24:9it4dt7SYdZeptWWY6CTRSQk3TtNzQtSkXHt7mPDJ4mkEXBAxoqptdnYWLk:9wm7DqiHjkzz0SYlmPDJ4TEXBCP/Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324578, "uuid": "c1382a79-38a5-4c86-bfc3-70f24d88ba9b", "value": 1332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324578, "uuid": "fe50d700-9b57-4c8b-9123-1aabd2972583", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324578, "uuid": "c230239c-aad2-4e63-8eed-fd48701b114c", "value": "photov_095048111801.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8169d4a3-8b28-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785314151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314151, "uuid": "904ffec3-e0b3-4e4f-8cfa-81cef6c41529", "comment": "Malware payload", "value": "ec108d25f471f967a673e5834ecb1ef9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314151, "uuid": "f95c649b-bae1-4aeb-8fee-c48ea8fe1cfa", "comment": "Malware payload", "value": "e03576ef95910013498efcba8de6509fb5f90398463f070667573e72b24d8607", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314151, "uuid": "d9dd4446-f1de-4102-af94-318567ccaa3d", "comment": "Malware payload", "value": "dd1cbad05b68592fcf4b064e104f1f4abf93a8d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785314151, "uuid": "0994b0bd-8031-497b-828e-9d5a0e5dfff6", "comment": "Malware payload", "value": "6bf507dff49fd1641ace317827dbc535ddf7261099002071c09cf2adcc6e08bdbc4c8f9440fffcbe76884000f79ea13b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314151, "uuid": "cf4b547f-6bc3-4d15-90d0-fa6b20fc1ff6", "value": "T1AC016BD6D650EA504069D96E73DB51E0B420C3C60A4A8BBCBFDC952DEB88E14B066F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314151, "uuid": "0f668676-df04-43f4-922a-1e5adc790cb7", "value": "12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkalFCpQfUCnjl1CVixXCQesq8CGb0auD:kXCKysE2hi0ziQvZohafcRa14itnFC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785314151, "uuid": "290a16b3-791b-4e56-b438-31550f8025ff", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785314151, "uuid": "851c80c4-8ca9-492c-92bf-57d302e196a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785314151, "uuid": "50b8f18d-721f-4516-8c99-f3c135ee60d5", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4326545-8b6d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785343952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785343952, "uuid": "2966f54e-1169-4ba7-aad8-d29879e18cca", "comment": "Malware payload", "value": "af38775c7c7dc7046f77a7748b89933d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785343952, "uuid": "8537606d-0c2a-48eb-9fb4-fa592c82b672", "comment": "Malware payload", "value": "e0968fdd46a966fd96963e0c082c826f0f4f68c6ae7c47db740e375b838a5166", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785343952, "uuid": "06864b4b-0d28-4374-a007-ba21cc227d73", "comment": "Malware payload", "value": "0664d2922ea22920f609f17e3f5b512623d940b5", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785343952, "uuid": "d90a2035-10fa-4688-af02-09d6b12bb2b0", "comment": "Malware payload", "value": "dc4f1771be31b37f331c19902b5d1c80899dece85101a4ad519fa6245b00e396217b4d74ddd14c43d6bbed125c6f03e2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785343952, "uuid": "8417426a-0896-41eb-b4df-1b4a51225542", "value": "T10BE6331869F401EDE873813CE9E11969E2A4746B2B32C2EF279C57617C772D28E3E513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785343952, "uuid": "dfa0f97f-0049-4e9e-9aaa-cff02cec8138", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785343952, "uuid": "ce106e59-73c6-422b-a82d-8c25382dced9", "value": "393216:ogcbfcVqSUG/Zs5cpMkXMCHWUjXscuI3/PGTAI:ogcwhfpVXMb8X5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785343952, "uuid": "9948fdeb-a34b-4904-883d-541970632ee6", "value": 14298665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785343952, "uuid": "e353d3b7-e480-410e-83bf-26d3c1c3c2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785343952, "uuid": "d934101d-c455-408d-8c35-2ae4d57395eb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce53e27-8b5a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785335618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335618, "uuid": "5d9794ff-4625-4e15-9847-6a4fa613315a", "comment": "Malware payload (Mirai)", "value": "d42b40f4a4a0b2bce4c646c84e62e399", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335618, "uuid": "b082e112-72c8-48af-ae5a-e324b1c3176f", "comment": "Malware payload (Mirai)", "value": "e0b1b9f88a12afaacf82cc053719ad44a176a6799a76b9b96109677ca52e0e50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335618, "uuid": "dc4fedd1-5e4b-437a-8efa-52feea2144e9", "comment": "Malware payload (Mirai)", "value": "2825128e1d675b78a19d76ddbcd540b870af5bd6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785335618, "uuid": "0bb5c140-568d-4940-a7f3-f8c6abfa5374", "comment": "Malware payload (Mirai)", "value": "960f2e13c250045cba3085875d5992032273809461b382a125300fa59d1e5e874a57f618e951b75f26f584fbd1d33259", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335618, "uuid": "477988cc-4feb-43c9-881f-a7a8c66988ca", "value": "T1AAA35CC5F683E5F6FC1251B51037A7338733D839502ADA93C3ADEE27AC126519A1B62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335618, "uuid": "0bd44db7-ba2c-4c7f-af6e-d26269202a77", "value": "1536:pGo2GhdLq4IunJSDHKDxgVaocNJ0SC1Oq5SwtwW+:pGxGhx/JSDGgFcbDcQNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785335618, "uuid": "addd53c7-c06e-41a0-bf26-d1387987bb2d", "value": 100684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785335618, "uuid": "5df515cb-b5b1-48fd-9f08-da356a7d4830", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785335618, "uuid": "205437fd-eeba-4373-82b1-199fd107fd46", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808b5c04-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333047, "uuid": "e9562552-1d8b-4c68-b42d-8dd8944b8e2f", "comment": "Malware payload (Mirai)", "value": "8f0faddc8925809171fd90797a0ef576", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333047, "uuid": "0beb315f-8c98-4e8e-b9af-4d7c6d5d1c8a", "comment": "Malware payload (Mirai)", "value": "e0bd961a9996be6496dc694f0f21576ff7cb50e53ba69f15bf21350451473c4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333047, "uuid": "a95a777e-3710-44df-a25d-82e2d3426e76", "comment": "Malware payload (Mirai)", "value": "3d3fa79d3cfce13a5a4b8964f898ecebbf54dda9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333047, "uuid": "af631a17-7929-4570-b0cd-29ac8515856a", "comment": "Malware payload (Mirai)", "value": "7cb2f113fae004006dedbaeb25247c2373233260c094c011c9cc71e9d422a30f688ae6e25808e58455d6e0e4912a9372", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333047, "uuid": "ba36ee72-842d-47b3-8d51-e0e32a721169", "value": "T1C7242A8AFC81AF6596C526BBFE2E418A331317B8D2EB71129D145F2473CA94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333047, "uuid": "a222ecb5-d0f7-4421-8af5-0f93219841ab", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqR:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333047, "uuid": "5bf81690-3724-4ebb-a6c0-c760a9e4924d", "value": 228864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333047, "uuid": "dbb4a224-3db7-47b6-b1c3-7c92796e41af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333047, "uuid": "19056804-6c1c-4114-9bfa-07b9b170c161", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9793cf72-8b6f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785344682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344682, "uuid": "80c54935-3824-467d-acf8-2c94ca867b88", "comment": "Malware payload (Mirai)", "value": "d2cfac43ed8dd2718854a51150c4a0c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344682, "uuid": "f2d2bffa-5c47-4e46-849b-fe35d19475dc", "comment": "Malware payload (Mirai)", "value": "e1abefa9c4682f8f429121b5b54b5443dc36a561abd5f0506f3d5f5ed5932627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344682, "uuid": "8b62575c-1469-4e67-b9bd-28411932df83", "comment": "Malware payload (Mirai)", "value": "ef056fd5d5089b6695a2f044216b4dca10339ace", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785344682, "uuid": "a6c5dcdf-a32e-4f4b-bcf5-4e53d9b37856", "comment": "Malware payload (Mirai)", "value": "ed7e3133e91a7d4f2b772b6a525a5e512d2f1954a8c6614a9f4633fde09230b9d2fb08cd988b4bdd222cd75d081fe173", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344682, "uuid": "c65ae1df-e51b-4fda-a853-6e910e5f92fc", "value": "T1ABD38DC2B10D7EAEE1932D7DC14607136D0CDA91EC83811190B5BE476EA76E72E36AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344682, "uuid": "c2a42fea-1ccb-43b5-b8fd-c8e8057909d9", "value": "3072:nVVKWLcP/K3682kLIQsXS/Z/9zvdhLm4LLjWoX:nV5m/+glXShxvdtm4XTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785344682, "uuid": "780bd544-9dd2-4b6d-8de7-9a76658942a4", "value": 133580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785344682, "uuid": "602f96d2-87b9-4b9c-8c56-1b101d13162e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785344682, "uuid": "9b68f137-5933-477f-b9dc-537e59e8a79c", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48517773-8b1a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785308042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308042, "uuid": "7b9b8219-18b6-4e53-8529-78f3e186f850", "comment": "Malware payload (Phorpiex)", "value": "8909e8de068e575e4c0076393abb4056", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308042, "uuid": "8b5cdc8c-8e2d-4f6e-90e4-4e73ee042efa", "comment": "Malware payload (Phorpiex)", "value": "e2075682a3b7d3aa51ab2864e35feca4d3331ee59430cbae634a443983ab64f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308042, "uuid": "406938ed-ead2-4592-afd1-7f4f72321801", "comment": "Malware payload (Phorpiex)", "value": "8f61ef8fed04bc51fe9b8f3fba649aa3a0b43b07", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785308042, "uuid": "2cf8b375-434b-47ce-b894-ed9b72915937", "comment": "Malware payload (Phorpiex)", "value": "13c11ed1cf1ea5a6a436371c58fdef3765255c91e9cad2f6bc6739340585144c8a9b074244648e45b4dc8ef6ec70b4d3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308042, "uuid": "63d185e5-330c-40b4-ba7a-5cbc2c118775", "value": "T1BB823B0FB8424316E1E110B49676967BD9B9AC7637C414EBFBD44AEE0A686C1FC3210F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308042, "uuid": "4efaa06f-ec4e-4dbd-9248-980179532ddb", "value": "dfba23467fe5a12366e7fde987218cb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308042, "uuid": "ed40ea4f-ed27-4592-9bf9-3e32c261650b", "value": "384:AJZbmcmhzcEUaUu94gXTP+av8U9c+C4P:x9UaF9Ka0U1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785308042, "uuid": "28f4f903-eeeb-48af-b018-fb46c90f2a6c", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785308042, "uuid": "ebee83b7-8207-4f2e-88c5-05163d6e4e5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785308042, "uuid": "987d2981-c4ba-442e-aee1-0ae1e9c88d85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e66b764-8ae7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785286255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286255, "uuid": "b7680e96-e6ed-4466-84a4-e8ce49ad3338", "comment": "Malware payload (Mirai)", "value": "669c31a8a3cd23c84de699bff9f93270", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286255, "uuid": "0f5b3e9f-f9a3-4606-bd87-0a2fc503f793", "comment": "Malware payload (Mirai)", "value": "e2f44b25a44109cea9ed49bb14fd4038da41912a75ccd2496194359af0eb1b41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286255, "uuid": "735bb582-4f57-4b1c-9f3d-58472e0fc2c1", "comment": "Malware payload (Mirai)", "value": "0a4d9f9d36987fee3f545abbb3a5f39aec8d0731", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785286255, "uuid": "0dc7b962-1516-4313-9a3b-c28ff5dc66dd", "comment": "Malware payload (Mirai)", "value": "66aff01ba76cd8e0c40a040e256ccbb4e514fc2a3e385ab4601c11782301f5857db165292ee9a12f5ee1273a72f24e7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286255, "uuid": "f9c5f0f9-3451-489a-ab90-dda4047050b2", "value": "T1CCD36CC5F343E6F6D80604725027E736CA3692A6252DEE83D7A8DF76ECB1501C916E8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286255, "uuid": "ea1e173d-eb58-4364-aef5-b72632d62621", "value": "1536:gvY+4cf9+gfLxGchrEMXV/BT4zkqeCrRPx2yO1K6E2SSx8KomX8jfHmWxLkb9EJO:ynf9+YLxT3NCMEF4yoK6T7x8VmX8PZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785286255, "uuid": "d5ae07d0-cf8f-4e0e-af8c-277eb61a9140", "value": 130632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785286255, "uuid": "967397a5-447c-4a6a-b83a-d62749fdb374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785286255, "uuid": "d644d38e-f424-418a-a16b-9e0841f776d8", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ff849e-8b07-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1785300175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300175, "uuid": "bf65ad25-e19c-45a2-85d3-d10ad7661a24", "comment": "Malware payload (Prometei)", "value": "c72b95d7a50cb634a5594853b7eab2c6", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300175, "uuid": "f4acafd6-a3b1-4f3f-94bf-79bf1b0792b1", "comment": "Malware payload (Prometei)", "value": "e479462010c2514b9fa8513bbd3d515fe665d58d6514f7e78411131ff3090ed9", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300175, "uuid": "b056f547-f93b-44c3-8cfb-6fb53dc693c2", "comment": "Malware payload (Prometei)", "value": "ad071d50197136b2f06e22991bc8322f70fed759", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300175, "uuid": "60817329-2ee4-4801-939b-6f2fdfd4f9db", "comment": "Malware payload (Prometei)", "value": "e21569552884c719a58339cbd47cacb9102e690f7a76274d640624fafbced5e6d0ccd2c69ae38fdcf179fcd09cdbd862", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300175, "uuid": "d2bd253c-e422-446b-a584-f5aee2e02d1f", "value": "T1A1311BE4B922DD30BA4C603CD61D25946887193F04387E0A799FBD343F2D24CB6AC5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300175, "uuid": "4a533412-c0d9-445a-9e2e-3f8fc5f11b54", "value": "48:Wml3V4zUz0cBm9lx6Xnu9kICapr8WeqvY6n2TlBnBsvL:WmP4uxem2r8WpvPalBn8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785300175, "uuid": "c1632e1c-2551-4952-8066-6a8c5a528d0f", "value": 1804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785300175, "uuid": "06f4e3bf-e302-4b83-b9b5-458ebf6f2c88", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300175, "uuid": "68e0b73f-7c72-4508-8008-0885e6708cf9", "value": "e479462010c2514b9fa8513bbd3d515fe665d58d6514f7e78411131ff3090ed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc0ab20-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351588, "uuid": "c4b15489-3747-44c3-9e41-97e836484859", "comment": "Malware payload (Mirai)", "value": "de1ec84da81cf7200ab550762cb23132", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351588, "uuid": "ab678440-9ac0-4ac1-8738-7c083b08dd58", "comment": "Malware payload (Mirai)", "value": "e4f89d9cc40ae3383da6c90a404b7403dd9e4d974ba98f483625fd7827758c7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351588, "uuid": "a51b0d98-432e-46bd-a90a-520e9390b26d", "comment": "Malware payload (Mirai)", "value": "aef2ed84957706aedac27a3239b78545ae706d34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351588, "uuid": "2f4dca8f-0db2-46d8-8a47-63114806bc7f", "comment": "Malware payload (Mirai)", "value": "1ce8d9d20a669e4c83bd4585d3d9ca72fc3e9ae827383caf3ee0605cf6ba9da3af2a5f978f8e0e04974da1e7e1cf7c2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351588, "uuid": "faffd2aa-fba9-4e4d-b8a2-90b10da49691", "value": "T1FBD30789BC818B00D5CA26B6FE0E164D33535BB8E3F9B1038E145B2A27CA95B0F77955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351588, "uuid": "a285fb0a-8734-44e9-92b5-032f2dcc33e8", "value": "3072:a20A7moawto3ToLmpMguHcUnVUHalw7WGuH0hsfCzl4Dh8XYY4S6hyZYM11qfaiV:a2t8ToLmpMguHcUnVUHalw7WGuH0hsfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351588, "uuid": "9dce5476-7e42-4083-8886-b8a69a5b6828", "value": 138788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351588, "uuid": "473273ef-8073-4396-90b1-12dfbcb44f74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351588, "uuid": "cc7d4f0b-a2ea-4ed6-8003-4cccd3eccb3a", "value": "zero.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493457ed-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785310620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310620, "uuid": "9c521f62-9cbd-44d1-aba5-6523846591c2", "comment": "Malware payload", "value": "e5c38b58ae3cd709c96c64c33e4ae252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310620, "uuid": "87405ecc-22e2-4302-8c19-0250d3d196cd", "comment": "Malware payload", "value": "e4fb9fa9a3d8167997133b6da09766b2113af3eebd1bc036d000648514610412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310620, "uuid": "5618dd87-3bb3-480b-a3ce-68b59b5df792", "comment": "Malware payload", "value": "f04a699156c4c556542d3a504d16afaf7c6a7f5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310620, "uuid": "70a0e2b4-88a9-4490-9eab-fb39178f7618", "comment": "Malware payload", "value": "e5356fb0ee8568404c9fde218f424611bfc7b3d6f5f223438b5c505cc61ab87200f6da07b34d81472a0b44e7ecc7f281", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310620, "uuid": "3afc8371-b224-4dc4-8fd5-f37487706575", "value": "T18E456C47F6A224BDC699C534831F9622EB31B85953117DFB22D0BB202F29FA06B3D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310620, "uuid": "43670a1c-e9ae-4db4-b4a2-24f55df2c329", "value": "12288:ceqnuB9miqOCoPQkCCLtfemynfurDTDIGDJjLKfLFOAppx189hZ1OF+VxikbooKx:R+1OTP5Cd2fFKTFOAppx189hO8pBK8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310620, "uuid": "bca749aa-5e58-4f17-9570-02317f12966f", "value": 1193944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310620, "uuid": "2386694c-f4df-498d-94ae-a019951c7dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310620, "uuid": "dfc0e983-7138-4351-a702-4883c90b7805", "value": "e4fb9fa9a3d8167997133b6da09766b2113af3eebd1bc036d000648514610412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d831b7c-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1785310628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310628, "uuid": "c068eff3-f5ca-40c2-b679-6dc9c6358fe7", "comment": "Malware payload (CoinMiner)", "value": "a316d6d67038de1f439cfafd6cfede08", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310628, "uuid": "c93c83d9-5618-4099-aa00-d57f6918a574", "comment": "Malware payload (CoinMiner)", "value": "e52e8e2ebfc9964e216fbee0d6a48423b59e6b4212b7a6d3a2ec7d5e72e300d9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310628, "uuid": "551f1f4c-7f1e-4d2f-a99e-161ba3c2681b", "comment": "Malware payload (CoinMiner)", "value": "d6f4984c8039260eb4fadaba30972db742b1a114", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310628, "uuid": "4f7ac67e-921f-4761-8515-bbb5d32d9fe7", "comment": "Malware payload (CoinMiner)", "value": "6e35f1475b1727f3bf8f0cf49a8bbce2dde4e4c4acb4cce65ef64704b17e48e60aaba277b3b981db0ccb4d9767fa4562", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310628, "uuid": "8b26224f-86f9-41b5-89d1-dfe3be51ea4b", "value": "T17BE56D0BB6A258BDC1E6C430875BD563ED35785942217A7B3684AB302B33F605F2EF61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310628, "uuid": "a6f66136-e167-4db7-9bda-1ff788c4a155", "value": "49152:Z5Gc+dp/QN1A9aNCSAgn8KDTgri4ghdZawDVJciYOBuY9IelPaf2NUfTRWQa1FzR:KcI/Da46ai9BBGlWQaRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310628, "uuid": "2cfda159-934e-4631-9264-3a19316dcd5e", "value": 3084976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310628, "uuid": "8acd0c47-404d-424a-8d01-0b2107ad3d8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310628, "uuid": "0ce4e2fd-3c22-4910-b651-809b3a65b997", "value": "e52e8e2ebfc9964e216fbee0d6a48423b59e6b4212b7a6d3a2ec7d5e72e300d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ac478c-8b20-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785310618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310618, "uuid": "9beb22a8-b166-465c-b546-75e4e4ffb77e", "comment": "Malware payload", "value": "4e50f5992c18502e7b68e2418d57fbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310618, "uuid": "756f79a1-7447-4659-a74c-64dedb58334d", "comment": "Malware payload", "value": "e5b05cd22ea137f29351c6995e43eea0c5ec082e70ee3b6012e9c06c31068586", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310618, "uuid": "84e658a2-3c4c-4215-a16e-e1ea68556f3f", "comment": "Malware payload", "value": "87df46df4d970821809dd2756b58a3407782e0ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785310618, "uuid": "bb8ec58b-db19-4954-8f78-6cc091a2ecb6", "comment": "Malware payload", "value": "9be65b4ea540c8728419cda82608e8fedfc1d9dd2353243778780f6cfaeec5bcc0b68cfcf85e5445a445eb4aaf0d0e00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310618, "uuid": "ec06d667-92c6-42b1-bd3e-3da77b430acf", "value": "T11E456C47B5A224BDCA99C534435F9623EB31B85583217DEB22D0BB202F29FA09F3D751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310618, "uuid": "65c9a7dd-2cae-4a2c-bdbd-5a7dd5f2714e", "value": "12288:hmqnGnEAulW/h9+rCFkU/3rL90wNB87XbYvqBkgdi4TOXFM/1MxAyFsVXnoiHeFs:U+6WmhaC/HMXbddTOXFM/1mA9RY1s76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785310618, "uuid": "1b18e59d-951e-401e-b14a-1cf6a48d796a", "value": 1209464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785310618, "uuid": "20b04b2f-d295-496c-b8cf-6dfec8dfd57d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785310618, "uuid": "da848b7e-85b7-4ab2-b7dd-6b28077a4823", "value": "e5b05cd22ea137f29351c6995e43eea0c5ec082e70ee3b6012e9c06c31068586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c03c321-8b7c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350219, "uuid": "340290d8-a696-46d1-9d13-06a77f855f83", "comment": "Malware payload (Mirai)", "value": "5c6edab14d549372b09e2e62307fe466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350219, "uuid": "e253b400-8600-4c88-9b3f-27c597ce53ed", "comment": "Malware payload (Mirai)", "value": "e84b8cad66bc7602107b7ef59178595b3dcc4843f8846b835f3316e1a4182185", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350219, "uuid": "7ef81b35-f43f-4ed6-9eb2-19dd3b3bb1c4", "comment": "Malware payload (Mirai)", "value": "aa722a613975c48209f17ed6177684bb2fdb710f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350219, "uuid": "99ca241b-59c8-4b25-b207-089deb785ab9", "comment": "Malware payload (Mirai)", "value": "b46accc1498d304904843930d6b1bb28db84df0203d1ba27c3071c31431d8ec0e4746c642c39774ee228a85b2ee89c08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350219, "uuid": "8658a4bf-145e-44c4-8fbd-f57de3376ef9", "value": "T12124C71F6E228F7EF269873547B78E25A75933D623D0D545E1ACC2101E6038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350219, "uuid": "f1fc7488-8ba6-4361-b03e-863881a3c980", "value": "3072:BnI9LiixLKsHlxunBu6RwMyVG2JHD7mIIInEWsY2c4SEW:BIUyLKsHlxu06Rl2ZvI5WsDcjEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350219, "uuid": "9f00528c-b891-4d03-be87-2d4ab2df431f", "value": 226004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350219, "uuid": "d45ed055-90e8-4c96-a800-69062869b4ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350219, "uuid": "33d86c7e-c147-45c3-b753-0dbc4312cb47", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed9ded7-8b7b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785349768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349768, "uuid": "533dd14e-f98e-4a12-ba06-67fa89caab2b", "comment": "Malware payload (Mirai)", "value": "087b71f21e8fe441321088b5c9578287", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349768, "uuid": "066aa468-0016-4dc0-aeca-0c403a615c7b", "comment": "Malware payload (Mirai)", "value": "e87b87e7cca0f235c07ad91bd09b8df76155ab6dd172d4ea324e06a6477acafd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349768, "uuid": "e460f94c-4dc9-4f89-b66a-4a681a87bcad", "comment": "Malware payload (Mirai)", "value": "c637f65c020da7c728b5e7cb010732f8e0894c0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785349768, "uuid": "a7e4c60b-29bc-4be8-a680-b930361a78b2", "comment": "Malware payload (Mirai)", "value": "958b38d3c67e4ed4bae0d179e24fa3e8e1d97f085edb21b1e9b98b30e0c3afc93a6e8a9855c06774bd8cff344407bbcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349768, "uuid": "e100eb32-c118-40e9-859d-a2d9a69edaac", "value": "T16C530282C0D78BD6EFFD8275849FFC858406B24DFA8026C367DD6234F156B01B664A27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349768, "uuid": "8c9d221c-b14e-477f-843c-4b9779b1c3a5", "value": "1536:3T+B0k4lbVw83EqhAm7G3c+QTtbIr0iUfxgMnouy8DMF:/xEqhdG3Es0iU+MoutDMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785349768, "uuid": "6d7640e6-2238-433f-9670-653e2c2a6a96", "value": 64756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785349768, "uuid": "c22bc2b4-1fa5-4ba1-ace7-443730606f69", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785349768, "uuid": "07cab387-91a2-4a6e-a93b-32f891b48623", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fd4bc1-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351518, "uuid": "d71e478e-a580-46c6-b05a-698a0408e753", "comment": "Malware payload (Mirai)", "value": "3c764098ffadee7674900dde946aa502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351518, "uuid": "832bd530-00c6-4f50-a7a6-8f384f221d08", "comment": "Malware payload (Mirai)", "value": "e8e0c818a9b4fc92cdc651f4054325da6b3e1f1754710704c2e3c1f6694138f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351518, "uuid": "01cdbf7e-b20c-4e19-82db-3213a60542f3", "comment": "Malware payload (Mirai)", "value": "c73bb9e271bbea91fc3c6f22a6a40cbfb324d1f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351518, "uuid": "5eb35b68-7238-4ccf-8eac-9d0b30f08bb0", "comment": "Malware payload (Mirai)", "value": "fa70d2a5abf947d1889eb855bc1ecb22eec2fc2dcac9e9f2711f32dcda01a68e47ff010f436039e45893e55359107110", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351518, "uuid": "9d5a1d20-a244-46a2-982c-7c31e1eac436", "value": "T15F43F1212A0E3B83EEB81877FB5E9603360C1A725ECC3A8712352B4DFBA255525757CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351518, "uuid": "b8e42aa6-f1fb-4c31-a6e7-f62a43c5b436", "value": "1536:Wl7I/0M6SBqPUXbianMiY9UJuH3uUt5TBbS2aFtfg:Wl7HaqUi2nY9UJuH+UjBbrEtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351518, "uuid": "ce86f702-2e6c-4907-9144-c61f103d4dc7", "value": 58936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351518, "uuid": "3e0c00c0-8b1c-413d-8745-2eb3398d72b8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351518, "uuid": "4f3cefac-98a3-4d97-8ac5-af41ae21c108", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe7be24-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785307303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307303, "uuid": "ce31f646-626d-4e17-9d29-d9c4b210d5ad", "comment": "Malware payload (Mirai)", "value": "8b519a2b963066996aceb57a0be0375c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307303, "uuid": "27c0dcd2-bbe5-4e72-8f67-a7b11d19fc8a", "comment": "Malware payload (Mirai)", "value": "e9579f5f3ea9b3190bb6d58af9a26fbd15cdbf525f403717ed246bfcefdfa65f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307303, "uuid": "bfe9bc09-ddaf-47c7-acdd-616266fa8e1c", "comment": "Malware payload (Mirai)", "value": "a24585399aedae3a0e5882ca3ef4004ca88620ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307303, "uuid": "fe138eb0-c5a8-42c1-a7b4-2aabed7abb47", "comment": "Malware payload (Mirai)", "value": "db8313ef11dc040bedcb7b889d53a4c540fb7eaefa836f01fa3e7256427d7321df803b94770a3d1852d08be9a17d17b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307303, "uuid": "edb2dea5-9547-4d6d-83e6-4a81b5fe4824", "value": "T10C63C74A6E219FEDF76887304BB74A21979C33D627E0D684D19CE5001F6034E686FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307303, "uuid": "63df0435-805d-49b6-8173-c50c2f67e947", "value": "768:SqFx6NsRyMfGgDlI8U0/XfSDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDFZjjjjjjjG:8NsJY4cAUKTMQVx+JWArC1me4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307303, "uuid": "23cacfc5-4bd0-499c-ae81-559215aca774", "value": 72364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307303, "uuid": "8bbc1c12-4cb4-425a-a318-576488cf3fb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307303, "uuid": "67f93d31-b9f4-482d-8d3c-62169a9a159a", "value": "real_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e3d525-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324620, "uuid": "cdd2b4ff-ca69-436f-afc9-2bd810efbb40", "comment": "Malware payload", "value": "85717735af709f1b38c5f33bbf12177b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324620, "uuid": "5a16de6d-7446-46c5-a8dc-0455b6e8bf14", "comment": "Malware payload", "value": "e996cfdad8da2c623d24005b615276179f74b64a0cc3ff1e0de40f73e6ff8ce0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324620, "uuid": "f7a54adb-e4d6-41df-9123-e17696111619", "comment": "Malware payload", "value": "280066b48e0c94530614c66e24da2c743bbcfab0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324620, "uuid": "1025c4a6-52d2-4b69-bc7e-e9017e79606c", "comment": "Malware payload", "value": "5e6e014558dca9cf50f387ec12e882ce79523b7c05ae3a94e2c245861abcef5d4e2ae485b89b6b9d38bb5bd59e24b3bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324620, "uuid": "989a9b8e-8292-4284-b7e0-3ff3d2591b52", "value": "T1A121C850DAEDC758C5E35636F8360AAC3460A1154605CBEA775A8A4EB459208920BE3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324620, "uuid": "51b2f134-15bd-4705-b802-42b8572f8fd2", "value": "24:9rVQQWvmDIQNqEshGDDsLFLzlOBUPja167CwF4l+d4KYmk0TbvAxkLGiBeR4KT:9rP9iODwZjB7CipXYT0Tr1LGiqXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324620, "uuid": "bd4c110d-fb05-4afb-b14d-7d58100c573e", "value": 1349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324620, "uuid": "a17ee374-748d-44ed-8b36-a8dcc42d51d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324620, "uuid": "0b5bbfff-0e2b-4fcd-b9bf-163872e4aa89", "value": "photov_961998800370.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3f548b-8b63-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1785339403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339403, "uuid": "43d42bde-4be2-4cd4-a476-afc91ff8bfe9", "comment": "Malware payload (AgentTesla)", "value": "c9d073ae0783c17d1c211a9fa1658ed8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339403, "uuid": "986c2a24-c6fe-485f-9507-639978153206", "comment": "Malware payload (AgentTesla)", "value": "e9d45ec597fd2f9ac69d259f8f03c4646cf34b59ab07fe2aaf942174d727a8fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339403, "uuid": "8fff159f-293e-4eb0-a3c5-750e3d95ba4a", "comment": "Malware payload (AgentTesla)", "value": "b6e624c197a3eef97ca0105b3eb9e7c3b8138702", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339403, "uuid": "957acf16-a3aa-40c9-b583-819e8fa71aef", "comment": "Malware payload (AgentTesla)", "value": "41e82c71ce1e8f5aa57654d1096dc2526548329ddaf22c143be6d8592c8a62f07e0f80cfd8111741d9e0777c5a029097", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339403, "uuid": "35eb13d0-e201-49b3-a9fe-256ecdd56bc9", "value": "T1D074CF9AFF70E8D2C57C16708B7786150632EF984A56072B2A50F26F7E72602CDA7F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339403, "uuid": "f60f50a6-55b1-4645-811b-68fcaa426c7f", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339403, "uuid": "ceebca24-b4fb-4d45-b42d-b03cd869ff7b", "value": "6144:E+MvoJEiU4oWwomiaZvNOTTGi0df0A59kr3wDWhTolgAtI57Z:E+e4oWwomiaXO+rdf09gKRolg/pZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785339403, "uuid": "61e20c9c-cad5-4953-809b-1d2d98ebdfd4", "value": 368688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785339403, "uuid": "0153ec32-f421-4779-8c58-48006bdf35a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339403, "uuid": "eeee0631-6544-4323-a61c-e12faa85fa3b", "value": "Orden de compra.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba889b65-8ae3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785284611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284611, "uuid": "6818a685-23be-4605-98b8-1bd721c15d91", "comment": "Malware payload (Mirai)", "value": "71c1763d06711bf697faee183da0b531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284611, "uuid": "33d5da44-bf5c-4c55-a24b-8d3d9abf25c9", "comment": "Malware payload (Mirai)", "value": "ea1da54f1c5b56aeed6fb6d138027f295c54713205b24d10371e8f0f42326ff1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284611, "uuid": "90d10bde-0f3d-40ee-abdf-cdf5bcff4704", "comment": "Malware payload (Mirai)", "value": "b6f389d7dd72db88f1619c13b5c48e03a0123c42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785284611, "uuid": "76b014f4-7100-46da-9130-0b1aea277d4a", "comment": "Malware payload (Mirai)", "value": "57dcab8aad3979e235c0a99b7bfedf88101d225c561d07941bab5f3ed055f29a716314c2e1f0e4fe64e50122339b77f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284611, "uuid": "75d15e83-c9b3-4b2c-9e2b-925cdc7cb15e", "value": "T15B836CC8F753E0F0DD1B0570054FB72A8A75AE529124DE6EDB987E326D32B13621B62C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284611, "uuid": "4de336b9-1aea-4d62-9a1c-dad7cac809a1", "value": "1536:UovA8vFuKT7ajKm6p9KgJK/a8xuAWE6wkKgb85HUP31QGtNQcezr:UiAFk7ajKmY9Kg9+uf31uA23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785284611, "uuid": "c8d86d7b-bf83-43d0-821a-070492ee74f2", "value": 82784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785284611, "uuid": "a257eaa9-7c6f-4351-ae24-9d880203e0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785284611, "uuid": "0f46c383-325a-430b-84ec-58b39d096b19", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20f869d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324540, "uuid": "db5804f6-0ec3-4d7a-8a1b-68e5d4d5eff9", "comment": "Malware payload", "value": "363085acc44b9d21f54619c8cd2359ec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324540, "uuid": "d09da596-e748-425f-9e54-8f4a82e93554", "comment": "Malware payload", "value": "ea867c92a10c8bb4d0121b06aa4bcfe05fa0e82f91077ad97b32141743523a87", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324540, "uuid": "2b87b7fc-0030-4df7-81ac-b053de7b49e1", "comment": "Malware payload", "value": "335f8618074230796bcdd6d1236e7c228b6d9f6a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324540, "uuid": "3d913394-024f-4458-9efb-42963934bb0b", "comment": "Malware payload", "value": "c12b44a21b530b08effff9fb35491ee992157e14f311d99acc5cc8773757715426c1eab1a4a60f6d77913eba7fabe5cf", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324540, "uuid": "c2a62b32-51ce-43ea-939a-a675aa7421a6", "value": "T19721B4B1E80D8F19FBF7A635BE285F82349421060DAB02A92C31E2C21D5E0CE1757AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324540, "uuid": "d91051ac-d17b-4110-a901-8a69e37a90f6", "value": "24:9MPdt1z9a6teX7kFn3AcNleCFJoQ4Hnmklx11zMWgzG4R5:9ydLz9aSeXmlewJo7nTZ1zMvr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324540, "uuid": "9de0a10b-11a4-43ba-a0cc-958f79c62103", "value": 1246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324540, "uuid": "ac1350c2-8e3c-4479-8f8e-e8c923369de0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324540, "uuid": "32e58e66-3d45-48c5-b200-d42ac2deabcd", "value": "photov_459199670625.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cef6e1b7-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307409, "uuid": "0c9572b0-8fd2-4366-9897-50859b89362b", "comment": "Malware payload", "value": "8518e5ca56c8a35e1e61995e30183091", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307409, "uuid": "d14fcbd9-6cfa-4daf-b8dd-a4623a8f4c62", "comment": "Malware payload", "value": "eabb7c5b0361963ad550fa2bdf7b60b64430cba2e1a89c4b3429d373f015af4f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307409, "uuid": "6e5bf080-41f5-43d2-8054-3369640aae04", "comment": "Malware payload", "value": "f2567feacb3ffca1d289b499bc70059a90bc14cf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307409, "uuid": "679fe4f3-be43-4eb9-8c6b-6c9732e8e182", "comment": "Malware payload", "value": "559d0bb8d25106f188fe38697e6c4ce8cf3e2d0bed7c2bb84b0dc623e08ff90d94a378c597b86b2c986c9918e24d6c9e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307409, "uuid": "50cf6a7d-db34-4e6b-9355-8ba14efdf611", "value": "T1F4C19E7105FB080CC8AF1EB87D5E61C2F69650D806D8CAC8BCAC0B0D671891E8CDA3A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307409, "uuid": "16c46401-408e-4c42-9966-f54be1be6651", "value": "96:qGZlMq9bYcSbvbmx04AY7SpNs6E+a/+ftnLc6luSQgG7:FfM2ibWuY+PW/UAIxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307409, "uuid": "5e3e2f01-a992-491b-bacb-ace20ecb1778", "value": 6036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307409, "uuid": "f14f0119-2b45-4d3b-a421-4f13792335a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307409, "uuid": "b0c1d0bf-73fa-412c-b999-1506e8764882", "value": "images_20260729_061622.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ec51bd-8af1-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785290370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290370, "uuid": "861b6b18-7700-421f-9216-8f30e5c4cec8", "comment": "Malware payload (Mirai)", "value": "fef8fcd25ca8007f5cd5d3eed991c1c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290370, "uuid": "e2e15a9b-1bdc-4cc9-a679-3aa2ed790e36", "comment": "Malware payload (Mirai)", "value": "eae10853be098476c31a1cb7d37c3b2dbc7ef80d73ce9d64306962eca8be8cc2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290370, "uuid": "9752abf5-dc27-41ca-8319-0f1b36c4901f", "comment": "Malware payload (Mirai)", "value": "0744720e7bc8ba5cd65c050f641fce7af1c28464", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785290370, "uuid": "ebe03e5b-8c9d-4224-8980-d5aa75e11688", "comment": "Malware payload (Mirai)", "value": "33676e46c5132d5077d5627249cf66431c50135256b160bc00a1cf0e91cd736584cd8b6d4df5b0b6645e6d7d6cd258b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290370, "uuid": "e0c05c8f-0814-462c-adac-12cef4b2fc3e", "value": "T17F044956B9C188FEC4D9D1780BFAF437E931F0AD526CB25727C4AE261E4DE204B2CA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290370, "uuid": "103f5225-1b68-409f-b7d9-b23fb3cb3d95", "value": "3072:Vw/DeklbF3a9sFuWS1ZVquHa1Uz1V6Dr1TkqdXxhbO/csFA/4:VwbeklbF3+FWItAgVOTdBjYA/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785290370, "uuid": "3bb28df5-623d-41c0-9395-8bbff1ec5919", "value": 182888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785290370, "uuid": "3805fe9d-b212-4390-b3e5-bfa8166d1917", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785290370, "uuid": "881ca967-e023-4c03-a20b-ef893e0729cf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b4f8a49-8b64-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785339722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339722, "uuid": "1faf1e7e-d0af-4c51-bfe7-40a2ba9f98b8", "comment": "Malware payload (Mirai)", "value": "8df4f4d2a03a0c9abec2b5e75ac4e765", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339722, "uuid": "6b664485-b0f7-4f3a-ac47-2bad02932f27", "comment": "Malware payload (Mirai)", "value": "eb42d41b5d7fee9a040b863110ff675b6e907a4e570a3d2489728fe61ff8feac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339722, "uuid": "f841da79-6979-41fe-8b34-63d0a98e3c54", "comment": "Malware payload (Mirai)", "value": "70e5323c06a5c60fab36880c50b3bd1d0e0b94a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785339722, "uuid": "09b26339-5fc8-48b0-b041-92c90532b6fe", "comment": "Malware payload (Mirai)", "value": "729c6726b1f879861d86ad51cfbf7ed3eb2e45266574cdda8a1ab164589c69e2a60c2f59d1ca3712611ce3d593da0b55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339722, "uuid": "dc308a44-8d49-46a0-bb94-9475b99fa3b8", "value": "T124F31845FC519B13C6C612BBFB6E428D372A17A8D3EE32039D215F25378A85B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339722, "uuid": "dd495d76-9974-4a5f-8724-4ee6b9fd18a1", "value": "1536:v3hMMcEK1X6P/9MiaReUz80da2oUti4Vvx0TXqJH8JaZh2DwhdlK7wyw5VludfN9:v3hMxKZa5zNdaaw4H07qh8qUsBbgzrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785339722, "uuid": "b2b0a6dd-b303-4485-992f-eb95841b2a14", "value": 169632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785339722, "uuid": "19065412-f328-46d7-b448-49fef1893898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785339722, "uuid": "e8524020-39b0-4d62-ae3b-6c5ba6a7fefc", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecd3893-8b88-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785355378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355378, "uuid": "7830a7a2-ba07-415c-94a0-84d79e4806cb", "comment": "Malware payload", "value": "b98d443149c72fe624c2277d41d4b328", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355378, "uuid": "40ec6dee-87e9-433d-9689-906a656a622f", "comment": "Malware payload", "value": "eb8426a2c384270297500f7ee836f38c6ba86eb981f8729304f0dc022e8e2754", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355378, "uuid": "3c35400a-7713-4174-8eb4-64e64927b17c", "comment": "Malware payload", "value": "f494a6d308cb6b9d4ffe5e7ebf29b06fc2f9730c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785355378, "uuid": "d24d4135-7d0a-4e23-b2a4-814afafa0c6e", "comment": "Malware payload", "value": "5db4476888c99fb50fc77565c02db3390ec8d9f071f4edc2c03345ebb9e40f807559ecd29be274d4e109bf27384c577d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355378, "uuid": "79dbf3cd-ff01-46f4-b0a2-bae0f01472a5", "value": "T1E5235C2516857C24AE98C4361C7E2F0CB9AD43E6324452EE7FCB3CF28C4A6ADD109B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355378, "uuid": "1b3053bd-550e-40fa-9a67-0849e513c030", "value": "768:C+l9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:C+2cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785355378, "uuid": "f72071fe-bd12-43df-bb8b-66ab07544a03", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785355378, "uuid": "798fa7f1-addd-4137-9880-16642b9aa3b3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785355378, "uuid": "236b894a-e56a-4186-9ff4-c6c1aac7ab26", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "015643b7-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785333693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333693, "uuid": "fc7e21c0-8634-42b0-94dd-343367c0e23b", "comment": "Malware payload (ConnectWise)", "value": "9480a93d4617c0260a02aba0d7a973a3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333693, "uuid": "c1ced2fd-19c6-4acc-9c87-966bbc5710ad", "comment": "Malware payload (ConnectWise)", "value": "eba88b2d0eaa3aee3ed5065d902ae7445adf6f5874e3b47691637112168dca30", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333693, "uuid": "facf2163-3382-4458-aaf0-f0f9763758c7", "comment": "Malware payload (ConnectWise)", "value": "cead7717045a8f0869e81faafacc4da9901cadfa", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333693, "uuid": "a3480dd5-694f-44ce-90cd-501e9cb870df", "comment": "Malware payload (ConnectWise)", "value": "e90516d47f765d07b4b7667a7ee94272e931304bc5f791cf3b20973617f45756349b37e1d6dcb15e668f1befd62b8abf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333693, "uuid": "c13a239e-3985-425d-a527-607b97a539ad", "value": "T18946E003B3D599B7D07B8778ED7A46656734BC048311EAEB5394B9292F32BC04E32366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333693, "uuid": "8e96bd23-7c0e-4196-82c1-348fe9c1158d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333693, "uuid": "aef188fc-42f2-4aad-b8b9-007a4127dc47", "value": "98304:bzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:bhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333693, "uuid": "e8ce5979-43f8-423f-b18a-24fa34fc68ba", "value": 5687184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333693, "uuid": "eb6ed5a4-82f6-4aed-9a8a-2e897a210a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333693, "uuid": "58df6ac5-8341-45e0-9fe6-276e19ab2f8e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054b80b5-8b82-11f1-bd95-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1785352597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352597, "uuid": "1b84f22a-e88d-4d4a-af20-faa7a87bb8ca", "comment": "Malware payload (Phorpiex)", "value": "6edb9c07dccb6bbf836fb28a6560e921", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352597, "uuid": "b46d59f4-2b39-456f-a307-5df05acfea56", "comment": "Malware payload (Phorpiex)", "value": "ebd140217102e211a74b341198292a392a0e25ecf5ec1a53fb411c14c3b7b6f8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352597, "uuid": "113e420b-44b0-47c8-b629-60006a968c53", "comment": "Malware payload (Phorpiex)", "value": "eecbc3e7c7477bf7be9540285f1858fd8f237e3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785352597, "uuid": "2366ac72-bb64-4ba3-a7bf-82f010b564d5", "comment": "Malware payload (Phorpiex)", "value": "0e6d4087df82b2de29afb6acfa452525dba3f56436e12a249e7d0f35e516cbc8ea88b8c16d86632ae36ce55073f395be", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352597, "uuid": "bd45ef6b-4cea-4091-b8be-42284edc6853", "value": "T10F622B0EAA818035EAD10076827F422745BD6C7223D4BDDBF7A068CA5EB47D1F43156F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352597, "uuid": "1ccd00b0-d7ee-4042-8c5c-c659a400e039", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352597, "uuid": "5318a299-414c-44d6-a712-8ca98309e5bb", "value": "192:AX7wkiyXgzhDDAyxdq4lKQe33hg/FeaFResJKUSfTzwbkQaesmJxTmv8U9cthb9l:AZi3DAybqFBg/Uf9TmkQzFav8U9cxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785352597, "uuid": "1c858e6b-ea3a-405d-bbe3-4caf02023853", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785352597, "uuid": "d433c7e5-d322-4f5c-aeba-d9a5fd864ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785352597, "uuid": "097afa00-b831-4a2d-9e06-86737e286cbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a791b7-8b48-11f1-bd95-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1785327692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327692, "uuid": "e5a4d8eb-ecff-4fc3-bcef-b9881c2bb1a0", "comment": "Malware payload (PhantomStealer)", "value": "e6043aa4f57d642b4eb74a33b3fae7a6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327692, "uuid": "03ac9bed-e4b8-4bf6-804d-eeb8f453ce23", "comment": "Malware payload (PhantomStealer)", "value": "ec3f7bd79784eb5589f9692952d30b25493aae28d054eaf8fd30e90d399064b3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327692, "uuid": "9351bfa3-21c0-4269-9994-3e9fda4d5ccf", "comment": "Malware payload (PhantomStealer)", "value": "a83752b1e366fd6c7b7c3cd0f2e6c9b20b79be15", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327692, "uuid": "af470917-2891-4ae7-a094-763ab06e5fa3", "comment": "Malware payload (PhantomStealer)", "value": "ab3dab62fb4e0b03eac46bc15f8f76104b6e615e3422b59653870f6a3fbf4fcfdc08b970ca11f90c7415c206a53fd837", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327692, "uuid": "738a940f-2eb0-44d9-8580-72f2b31445ee", "value": "T17157A9EB31850D07B17F36298C0993FD0A6BD6253AB4AED299C1BE9EC351C618DD1363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327692, "uuid": "3cc1981b-2912-4228-bcd3-7196ea9f8607", "value": "192:NGwbe68z6TV1OessklkRU0tVzmwJ8/5YNp3Maw6FBmD6QSHggdYCDPxQ0jx1cqID:w5vmJHoFPBdNxCx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327692, "uuid": "f539c784-1e69-44ef-b508-5803e8cca71f", "value": 28530288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327692, "uuid": "4d83c836-0a49-4363-a095-b3531b21108b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327692, "uuid": "a1556bff-e6c3-46e7-8ebf-b01400451500", "value": "FedEx598577646738.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9463783b-8b90-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785358850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358850, "uuid": "898eeb2a-3881-4368-8cb3-ef59addf43b6", "comment": "Malware payload (Mirai)", "value": "38c9c210c20b01f91406d105b743f1da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358850, "uuid": "c08c322c-d89f-4a97-8c9e-f243daab0602", "comment": "Malware payload (Mirai)", "value": "ed2457fc9931b8af83ff1428339fd6acb8619b73cf0e82c2658180f8e718626d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358850, "uuid": "d7ee3883-308b-4ce8-a1a6-0e5f19b46dea", "comment": "Malware payload (Mirai)", "value": "98f6d9d0625db76ace958f72879a23af49849555", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785358850, "uuid": "685e54a0-7214-4e53-8aad-cd2d9c2649df", "comment": "Malware payload (Mirai)", "value": "669db87b4227dc86d6152fcb1e2dc14b476a97c4a5a5c614456bc38c11790c809071bc3f1a4db573b32d735caab8e78f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358850, "uuid": "113f9362-7df4-4456-bfeb-8d000af89e2c", "value": "T13863196BB9918F15C1C1567AFE1D534D33132BB8E3DEB213EE042B652B8B46B0E2A405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358850, "uuid": "30895524-169f-4c6b-8c47-d721ae16fdfd", "value": "1536:OxnPrZ5acdjPA7kBWv3pIcqAQKxV4iAwYieYWBJz4EWVMh:grBjI3IfAPxVREYWBJza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785358850, "uuid": "64b40482-2ed3-4504-bec4-49377bc7bff2", "value": 68084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785358850, "uuid": "5b093a5b-9754-4318-84d5-18110393c23c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785358850, "uuid": "196e92cc-5732-4f40-8a18-dc34566ce778", "value": "y1V", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529ae586-8b55-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333399, "uuid": "13cb88f0-cd5f-4718-be96-c1298089492c", "comment": "Malware payload", "value": "9c67140fea5c39a157b2e99aec1bd0de", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333399, "uuid": "0be56851-f94e-48bd-ab06-6750b01087dd", "comment": "Malware payload", "value": "ed443150ff389c2303606469b6339e9b96bec72ca695fcf82adc0f5f0130688f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333399, "uuid": "8df54175-3503-4bfb-9238-ff4f2c37fa22", "comment": "Malware payload", "value": "98c56a661338ad938ab6365a2c0d3ff7b71ec35c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333399, "uuid": "ea413233-358a-412e-82cf-836556338c26", "comment": "Malware payload", "value": "bc06f561f666aec98b937925d79e61a4f3a9881dea8e998247f8598f326f23dc9cd2c1a6bab8a46c82ab2c6ec4d634b3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333399, "uuid": "bbee8297-4a6d-47cf-b3c6-3134c425a791", "value": "T1C0236C651A857C149A98C4361D7E2F0CB9AD43E6320452DE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333399, "uuid": "33c2d268-9a02-4142-8e75-7f4eb002c05f", "value": "768:RVEJVIhtMa9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:/EJ2MPcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333399, "uuid": "05d314c0-8b32-4b23-809f-6443ae3240d2", "value": 50063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333399, "uuid": "a598532a-6ffe-496b-8e5e-f52418584e37", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333399, "uuid": "1b14fd6d-3e34-4cbd-b95a-ba6e42791a9a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c862e13f-8b17-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785306968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306968, "uuid": "8f037956-538a-4dfb-88fb-0c25e2062f73", "comment": "Malware payload", "value": "aed52f1f140e93f7373e2504549eed60", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306968, "uuid": "858cc67f-cbd8-4f25-9c54-6765719d4f58", "comment": "Malware payload", "value": "ed7240c8b599b5b5bbdafb145c1aa22547c7843b7c979fd82f1cee45a4ff580b", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306968, "uuid": "c8d363b4-b535-4b56-9b5c-eaea0b54dcd5", "comment": "Malware payload", "value": "5a15fd159f6984fcbe4d93f12847cfb6d53bcabc", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785306968, "uuid": "5e1689ec-71aa-4599-bd5f-923e69ba11d9", "comment": "Malware payload", "value": "58d66f203bf348c0707ee8d5b0b2e6785271899e7dfd39a6c922d0290f4ad347174324f008de35034280bff0f2bdb672", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "tenis-team-km-com", "colour": "#B17606", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "ycjlvalve-com", "colour": "#E3FD4F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "zlangbo-com", "colour": "#EEC1C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306968, "uuid": "7bcc9883-21c6-4961-a737-648cde11bf09", "value": "T1B926338AC4E6A1AEEC372834C7E9395153770072ADC3296F13E196A3D1D1994F2B35CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306968, "uuid": "104f4545-42de-4413-8165-b8cadf5fbd55", "value": "98304:hO3vV//UWp0PsSFhZUaVe5hGsNXrg18sb7bEU8oDEzYK0aBfy4px:hO3v7JSDXbsN72lb7bEtRzLjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785306968, "uuid": "7f2de871-38b8-4556-a831-94a86525bf97", "value": 4801633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785306968, "uuid": "f39c35b8-a9b5-453b-9e4d-97e873f924a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785306968, "uuid": "5e06bb18-d566-478c-977c-d5233314903c", "value": "tenis-team-km.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b9faf-8b52-11f1-bd95-42010a9c0009", "comment": "Malware payload (CarnavalHeist)", "timestamp": 1785332164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332164, "uuid": "ae9fb492-f546-4f78-b5d8-f9b18e0ea8a6", "comment": "Malware payload (CarnavalHeist)", "value": "7b81191dae680b4c7da82f66ee23484a", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CarnavalHeist", "colour": "#A4430B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nota-clouddriveservice-online", "colour": "#D2CD43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332164, "uuid": "51ac5b45-c3e7-4cc4-855f-89aa8d64f4e6", "comment": "Malware payload (CarnavalHeist)", "value": "ed97fdb82c3dbfc55cf1203cbe82eb3ca983c084efd86c4b173916ae682f5a77", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CarnavalHeist", "colour": "#A4430B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nota-clouddriveservice-online", "colour": "#D2CD43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332164, "uuid": "6677e8d6-3baa-4a5d-b1dd-80ec0a3a5a16", "comment": "Malware payload (CarnavalHeist)", "value": "71c344fd6895e34c249f58c90c8fb4e9cb508cfa", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CarnavalHeist", "colour": "#A4430B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nota-clouddriveservice-online", "colour": "#D2CD43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785332164, "uuid": "f5948bf5-58d3-4692-8232-97e3e61a8af5", "comment": "Malware payload (CarnavalHeist)", "value": "982a45bcf2646412b5f1a8c5983ce47e880ee9ccdd1c65643107a5be505515ea31eb17be45706a7a193f81a2dbf17b4b", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CarnavalHeist", "colour": "#A4430B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "nota-clouddriveservice-online", "colour": "#D2CD43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332164, "uuid": "41cc8f34-f56e-4905-9dcc-3bfaf634bb02", "value": "T1F671D8238E532C0547B9851E11CD49C5682C83C6A1976AEE33F7DFB4D64803E50FAA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332164, "uuid": "a8e55d8d-315a-4097-af71-03e319f4dfdb", "value": "48:NghMh9FJEcFGfDMipwUCcC77wy83goOA9yEPWLG9lLyNaAfGi8cqG1rz+iu7lhX2:NccwrMiq7wn3R+ElLNjUhyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785332164, "uuid": "581ca358-e590-4f7a-a484-fcaa3e89f9fc", "value": 3783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785332164, "uuid": "9c2975ea-f5e6-4509-97b7-df1745e7d024", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785332164, "uuid": "09582de1-8ae5-486b-a71f-5b84d3f610e3", "value": "ljjh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d159e9-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321134, "uuid": "828e8bf8-b9c0-476e-89b0-fe6af0feb721", "comment": "Malware payload (Stealc)", "value": "9aefb5da315cf02ef084b88028f5cef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321134, "uuid": "06390ee5-e733-4709-a569-090ae99d287f", "comment": "Malware payload (Stealc)", "value": "ee2169a39bff9da6e3152e80a13b0bd9dc1e55c3ab191ca387bf8ede1ebdcd8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321134, "uuid": "8444b142-627f-42aa-97bc-a21e17633fc1", "comment": "Malware payload (Stealc)", "value": "44d75ba16175c70d0cd60883ce28f59c9554f1b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321134, "uuid": "18a6b934-137f-4d33-b57a-ede473d4229f", "comment": "Malware payload (Stealc)", "value": "867e1e3abd303f2833df1f38007ef3b239f777a845639dc1663196ac833dbe3b5879d3fab89e15914441fc99545687e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321134, "uuid": "36a0429b-1dd2-44e2-aa4a-87339cf56cd4", "value": "T1EE059D1AF7A502FCD0BBC174CA524912EB72BC565330A69F03D15AA61F376A05F3EB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321134, "uuid": "5bebfc82-a6fa-4b36-bc6b-e129082a98ea", "value": "12288:0+mtSx7mW7LKiwFZnlMf6r60dJM8yxBlDetAqxSvY1c:zZ7n7GiwFZlC6+6JM8ybY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321134, "uuid": "79cf35c7-1350-451e-881c-abca88a433c9", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321134, "uuid": "05e8938a-af6e-4b34-ae73-3337ff313ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321134, "uuid": "8484e71c-132d-46f0-bd9f-204ef8f35b86", "value": "ee2169a39bff9da6e3152e80a13b0bd9dc1e55c3ab191ca387bf8ede1ebdcd8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc287c0-8b80-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351831, "uuid": "fc858f52-380f-4626-ab22-e3396f1f977a", "comment": "Malware payload (Mirai)", "value": "066e06846d74add594831b086bf6950b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351831, "uuid": "f6bb4700-5753-433f-bb9c-67c65f3c834b", "comment": "Malware payload (Mirai)", "value": "ee951324005c874fc6b65d8c0028d206a32c4d3efe1f719fca2e64f0542331ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351831, "uuid": "d0f57309-f3f0-4ff9-ac30-b920a0d2ff90", "comment": "Malware payload (Mirai)", "value": "62efd19336908f42a1b38f96a23fe3305b1d6388", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351831, "uuid": "8de72a18-13bc-440f-8e6e-0a06f395362e", "comment": "Malware payload (Mirai)", "value": "877f1f139b72d0e6c0851d93ac74a27e2fdc78f931062b317e8d52aa5b7d12e3a21990e981a420273d5e0129325e9cd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351831, "uuid": "c81b8b86-bfcf-478d-8675-c82fffa435dc", "value": "T1C5041A4B7B11CF61D32DD9300AB3CF9656E926621AD28449F21CDE183E25349B92FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351831, "uuid": "ab4e3c67-25a6-4c5e-8129-5cb9e9330da4", "value": "3072:ROBv/E5va7suz90UCmMGfWVOyEPLbXY69FM6yIvUVKlSws6cp+1Dqja:8vs5y7suz2opt9WwUVMiJp88a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351831, "uuid": "2a228cb5-e763-471a-938e-c61b9440a352", "value": 186128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351831, "uuid": "fd45e6df-7b57-40ec-9581-fda19e7eec7e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351831, "uuid": "14d129bc-328b-43e3-b3f6-8c123e8e9d6c", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad5625a-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324582, "uuid": "ded1c67e-b4dc-4c9b-9946-8683288342f3", "comment": "Malware payload", "value": "a416249b70390627a468ae29081b469b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324582, "uuid": "e1ddf3a1-e1cc-4fae-881a-b1cf84b48b60", "comment": "Malware payload", "value": "eeeeccfefa06df87ef0bfee361639661e1dc5002e5ffea3836ba01976a67a9b3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324582, "uuid": "ba372e27-b4a5-42ff-9400-78fda472ba53", "comment": "Malware payload", "value": "64d669f8ee3225fed43f71d8e08df2752d3259b5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324582, "uuid": "b33e6e36-631e-4d29-821d-9c78612f0701", "comment": "Malware payload", "value": "10d073f280197141983656b20eec02466679fe51392e3b8dd43bd238fbf49d80fe857bab71e91c998529b6415951d1a0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324582, "uuid": "67f50110-8b2a-4840-8c8e-048fb20f0ef9", "value": "T14821D720020A150DD0C37A70B3242D80E13BB276900ED47783B092DDBC6AEB49AD3680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324582, "uuid": "16d878c3-f2e1-4c82-951f-e57cac1f17c2", "value": "24:9UpxexxW97kTtCELdkrNmlBM4SFgncnTai1I5Fm0mk2jv/5cpeYUzgMp1+ehIOFR:9UpOekTtCELdaMwmi1I500TccpeY1MpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324582, "uuid": "56eaf14b-250c-4a6f-9986-64b16fd9b770", "value": 1254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324582, "uuid": "ed06f524-e088-43c6-b190-f343799df8f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324582, "uuid": "a6a5291c-1028-4137-bf89-7415f81278d6", "value": "photov_183117091485.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8043b5be-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324457, "uuid": "3c4efc95-2353-46f0-b712-a7c6e8878da6", "comment": "Malware payload", "value": "9ad07125f6517e87bf052015596a78fc", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324457, "uuid": "eef5c5cd-bc5e-4c41-bd68-ad1025a6cf38", "comment": "Malware payload", "value": "f022acb351605a921076735b3e9338232ba4afbec4509e0d1ef2974953496f30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324457, "uuid": "1d7c7d25-5eff-4328-97c0-5204ee685523", "comment": "Malware payload", "value": "d157ab78074952716747c914bee6e25177ed20ed", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324457, "uuid": "6b74c589-2c0a-4660-b79c-35ddaccfac13", "comment": "Malware payload", "value": "dee7df579c054e319629f25b9206ba2a834225dce305df53db470dd43191ae8c41160588d02754ee763ef6c56941be82", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324457, "uuid": "e189a90c-dc2d-4320-bf0f-895f98624379", "value": "T1A721FB8EEB2DC621FF5551363E190F64113E52F4145D8C8B627506806F1B7DC9643696", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324457, "uuid": "24524c12-8fc1-4e45-aa2b-4281d2b9ba2f", "value": "24:9IOO9p43Av/lOgaxIxd1xS5DIgmkqd1ebW3sW8xpatpaVlk51OCj:9Ix9pGI/MvIxd1xkTId1uypa41x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324457, "uuid": "ca01ae5c-88a2-4b6d-9a59-1ae8a6b1463a", "value": 1353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324457, "uuid": "4e97d714-f528-4af5-b601-248cad774b26", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324457, "uuid": "c8352b4e-dae9-4089-95d6-62ddb50a58ec", "value": "photov_420048308378.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e67792-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354482, "uuid": "b5fb19c7-893a-40d7-acf2-e9dd6313c4e7", "comment": "Malware payload", "value": "4e14169bf40da9dad9f5da6c6658366a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354482, "uuid": "30effd48-57a5-4295-ae8d-c2a00b7fce5d", "comment": "Malware payload", "value": "f051f14146e69ffd2f22c48c5126f53e8a94e2ce86b9adb46de0fb5230d46538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354482, "uuid": "866b1143-4825-44dd-90fa-32ddfe883c45", "comment": "Malware payload", "value": "daf8e4e1e763fb653b7f62f4f822716b3ac1444b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354482, "uuid": "dec71e46-eb06-4c7a-a99e-266ce78a1fcc", "comment": "Malware payload", "value": "85d4a8af8c54f14c84b62f37182f985795371ffd889803b8d7eebdd9f8402dfd1325fabff23947fc179e1b528356d5d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354482, "uuid": "0135dac8-e048-4756-9c2f-cc8fddd993e5", "value": "T138047D46B3A500BBE5B7C639CD631646E772780207609BDF03A042767F6B7D09D3AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354482, "uuid": "ec3426f6-161d-43b0-b4ad-26356dcd145e", "value": "c556f65b0320cbea87f199fb45a6de9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354482, "uuid": "efc3f742-0e27-4e79-835b-f68f5a55a96a", "value": "3072:hPiLnXpwGEhFb7ihrSer2pz655YaLv0Ved7/lpCwX:ALXOBzbmdrYz62edbPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354482, "uuid": "d303524c-8937-4a09-b724-4b36326825cd", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354482, "uuid": "989aa9ca-8599-423a-8f8e-4f83306e0ec8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354482, "uuid": "38281808-99dc-4a22-bce5-086a6a9edac1", "value": "f051f14146e69ffd2f22c48c5126f53e8a94e2ce86b9adb46de0fb5230d46538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d85cfe7e-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313867, "uuid": "98957128-239f-4a95-8c37-2e4a7021505a", "comment": "Malware payload (Mirai)", "value": "6c781cdeed169a6e71bf6b8c56d2b5de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313867, "uuid": "e996f16b-1024-4e36-9ddf-e5d2c57e6007", "comment": "Malware payload (Mirai)", "value": "f0947de60d236365f6e8500361a61ddd76cc80c80d1e6647554a6a9f7a2c14a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313867, "uuid": "d596afe9-9ee2-4e0e-8dba-0c7df2a2d97f", "comment": "Malware payload (Mirai)", "value": "e89a13909126def28579f98ad6f3e124438d5ca7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313867, "uuid": "0ec0a1a9-4e27-4a5a-b0b1-727cb0cac07b", "comment": "Malware payload (Mirai)", "value": "ea75a7e28149f5d8e73e5f808866570b89149173e043f5edd9b9aa1a0b8ed7eb5b3e660e2f4011745bf7c6ccf3722328", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313867, "uuid": "ce3b4d3b-472b-4fb9-ab60-b4f7f089246f", "value": "T1B983078AFC819B01D4D522BAFE1E128D335317BCE3EE72029D255B2527CA92F0E77542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313867, "uuid": "81ea1954-5fde-4180-918b-6d610ecb78c4", "value": "1536:ytnqecaAWqBSbq4QgSvilWNZYHocKsWFBP9a9lq3iRfeaCIV0fY7PtR:UT4h43RAZYHocKsWFBrYfeaCIafQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313867, "uuid": "03d9c5c5-f712-4ce7-88a1-10e375bf1d3d", "value": 87460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313867, "uuid": "768b4320-361d-4ae2-a18f-6d824d8fb7dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313867, "uuid": "fa828fd7-71b8-4785-b5e5-ee3d49db1d04", "value": "real_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb251d56-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307456, "uuid": "be393f6c-8457-4494-b362-cd367632de2b", "comment": "Malware payload", "value": "24e0cb4c3de083a047aaa0b7c7b1e5ab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307456, "uuid": "d5be9f3f-a39b-4e07-b1a0-b78933377525", "comment": "Malware payload", "value": "f0ae11ad6563377387972d1edca069529307efdfd6a83eb2da1dab900a7f46ed", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307456, "uuid": "01dac008-73e6-47c6-9745-6c4c768008f5", "comment": "Malware payload", "value": "1c7a7f908b99620b323b371c9e059072707074f1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307456, "uuid": "726a9503-e2a0-4573-a33d-a9e300600eeb", "comment": "Malware payload", "value": "2dc2c506f2f901222c286a55d424ee7d051102171a01c54a3befead1972bea872b61b61827e966b5bdfe407fb692730f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307456, "uuid": "65402739-7763-4332-a994-d95f2d9db75d", "value": "T1FB41F82C28DB6392EDB9A970A8C41EB0D7ECC702CE12DE57A8BAC09641312E85D47594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307456, "uuid": "03b1da5d-5b13-49e1-90b1-3474410986c7", "value": "48:9kDktUQBDAzHQY9o4N/CWa6rss0vpNjrt2z:zFmzHQY99AWPQ9t2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307456, "uuid": "b9ef7be2-ba8c-4b01-9ca8-4ec0f5d40543", "value": 2029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307456, "uuid": "2a3ef7f5-dab0-495a-93f5-c79c8c3eb340", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307456, "uuid": "60c86878-e1ce-40d0-8352-35b38ed8bc99", "value": "images_20260728_200524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca8bfe6-8ae9-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785287138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287138, "uuid": "07c1f5ed-9ae4-48e9-866b-7c0bbdea163a", "comment": "Malware payload (Mirai)", "value": "c39c5267c9ac48b45112f668febd042f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287138, "uuid": "9cb17a82-1c81-44a9-a67a-5c51238424c4", "comment": "Malware payload (Mirai)", "value": "f2b628567c9194272993484fc7b706d0ebf036e30fddab42cf0ef95310782b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287138, "uuid": "16df3d81-ff0b-436f-9a13-9271138c9163", "comment": "Malware payload (Mirai)", "value": "93057b9981cfed30ab46f974eff0782db5918074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785287138, "uuid": "901b6415-d9d4-4174-997f-c4b379e75aeb", "comment": "Malware payload (Mirai)", "value": "a58e92c1d30fb5584b66116c6735c61160a6e54cb9df42e0ef7fd44289bd3e1d779dcb94d3e81ac7980d81ef777728be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287138, "uuid": "91e3f5ab-9218-400c-83b3-0c4cd7044287", "value": "T1AF24D81F6E229F7EF6A9873547B78E24AB5933D613D1D541E1ACC1001E6038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287138, "uuid": "0ea72251-7916-4150-9ac3-1109227fd34b", "value": "3072:YzUX7ipxr9v+oDajycYJbKSP/IFtxQO0PxMG2a/Yl8c34joE:YIO7r9v+oDajsGSQtWvyGfYlh3y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785287138, "uuid": "187dedee-0b1c-427f-89a3-bb8bbe8cfe2d", "value": 226044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785287138, "uuid": "0a64926a-f3e2-4cc5-ac5e-6c24944a5e89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785287138, "uuid": "5a066b9c-c644-4b99-9ccc-cc6248cd2256", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728a87c4-8b56-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1785333883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333883, "uuid": "7a63ce63-4589-4974-8784-9191401f6b9a", "comment": "Malware payload (ConnectWise)", "value": "7e24bcfac39c612504d8f96883837345", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333883, "uuid": "610d107f-31dc-4a7e-beca-0f6467643f1d", "comment": "Malware payload (ConnectWise)", "value": "f40c9170ce158fb797deb5bd41f4110b51439d9fd9217944a01c325a6ca5c1c8", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333883, "uuid": "61c858fa-3077-4674-a2bc-0942f5185011", "comment": "Malware payload (ConnectWise)", "value": "b82702d2cf92c7bd40d2e0136ad988e60663eb73", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333883, "uuid": "8b3a9a22-66fd-4dba-974d-6b362e8a63a3", "comment": "Malware payload (ConnectWise)", "value": "8fb0c034f20115746c9fc720501133672975c682516cc7ab63bb406621767f0a86db7909f0b36c7274b03c765c156938", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333883, "uuid": "e2ce683a-c96b-445e-9127-01cdc29d6138", "value": "T169646C11B9C48432C673383147B8E2B28DBDB8301D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333883, "uuid": "e02f76ad-73be-4138-a63b-f727322ab445", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333883, "uuid": "91222d81-6501-4ea3-b385-42457d20fbdc", "value": "6144:qmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:Z1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333883, "uuid": "f8d1a334-1157-452b-93ac-778fcbf6b9c1", "value": 312520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333883, "uuid": "56fe6a58-42d4-4115-aaea-48a0f23efdcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333883, "uuid": "8feb6e74-0f91-4fa3-a879-9f9630e309d3", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d35ced-8aed-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785288870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288870, "uuid": "43797fef-6186-4989-bc20-0fa2e02ea41e", "comment": "Malware payload (Mirai)", "value": "c78f84e27a9d0e544c00e1c3a4fb5798", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288870, "uuid": "4d2cc71f-3d19-4e0c-9ec0-7cd6e130cbf3", "comment": "Malware payload (Mirai)", "value": "f47db0bc0f9accb6cf4c033d81ceb1f79065c54616f90df4647ec0cb2d6f2ac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288870, "uuid": "008c9bad-f176-4134-b1c8-9eb2a138fa21", "comment": "Malware payload (Mirai)", "value": "58d8cb699d5da0ea10acdb829c1fb29d6eb587d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785288870, "uuid": "9190fd4b-e57c-40d9-beef-f631cdf47c13", "comment": "Malware payload (Mirai)", "value": "7a0ed99a6c7220836c297eb27ada37ca8651626325073aa7a81a164b704c02cd915d3459f88fc4818f9cdc279376bc3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288870, "uuid": "d03bd51c-c887-4b71-91e5-84949521c861", "value": "T1FC144AC7F801CDBEF80BF3764857040975B0B79164935A3B63A779ABAC3A0D52923D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288870, "uuid": "66a8cafe-ae63-4279-9611-14270b29f28f", "value": "3072:LXKHbrDEmBRai/26mT84H/ImMSV8jbiTL52lKy3Qcaafg:jK7Xwi/26mQ4wmMUL5y3iMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785288870, "uuid": "301d9506-65e1-4379-9763-3d01f737b573", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785288870, "uuid": "a05dfe98-7519-485a-b7de-70e34357daec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785288870, "uuid": "8714adb2-2d59-4241-aea2-e7ac91fab844", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f7764d-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324433, "uuid": "9da1c1a6-4ed1-4834-86bd-af46211eb270", "comment": "Malware payload", "value": "0cf2efa73ba34df217ea38bf717c279e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324433, "uuid": "a5196e92-138b-4526-a27f-9a59e697822d", "comment": "Malware payload", "value": "f4b3816a777574f642113def076a0dd356e668af8e3354185759f682172a2fd4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324433, "uuid": "eaeb04d7-0467-49b6-865e-52632421362c", "comment": "Malware payload", "value": "ad1bec9ee9ba94699e07abcd9df0b67983caed45", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324433, "uuid": "405c5d13-6ae4-4e78-85e1-c0930e984f9f", "comment": "Malware payload", "value": "6080239c70bfba717032d03927866da4d415b291abc479a50e0368a2cd93ad9a90c833f17065f7d2c713b39c4269fd33", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324433, "uuid": "63f408e4-5e71-48ca-8944-639ea797b6e4", "value": "T1ED31C918CB8D1300F551EAFC7D3DE61E365AC2850094CB23056A50C6F78F4930B9ACE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324433, "uuid": "06e4c0fe-04a0-48e2-90e3-9e74cd399a6b", "value": "24:9Oyo4rlkeV1TN0ujg/Ma509M2nsrmkZ++UaNuUamD+7Yp/pgbzYBn:9dZ93qn06lTZ++UkO16gbmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324433, "uuid": "ed279c97-3e9f-4c96-834a-0226481d2955", "value": 1481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324433, "uuid": "ac5b845f-a9fd-4d83-b8b1-93d030cdb456", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324433, "uuid": "5dfcc60a-f025-4900-b849-03a017c58066", "value": "photov_776274188255.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc51b76-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333046, "uuid": "4e97d320-56fe-4548-b536-bb1b9a1c0199", "comment": "Malware payload", "value": "5e2b5b5ba7b1e9e7d36937457fd494b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333046, "uuid": "7abdfd8a-da2e-4b4e-a62d-2251928f31e4", "comment": "Malware payload", "value": "f4bbdfa60e288f6a8e0f132afaa86cf7b5ac3ce2594788ec7a101c2aaf8dd66e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333046, "uuid": "e54326ca-b736-4882-b21c-6486f59ccc71", "comment": "Malware payload", "value": "4b52bc520695c1ebf707652854fbeb034089ad6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333046, "uuid": "6c72c141-1b3b-467e-a1a4-6dc64a00647c", "comment": "Malware payload", "value": "ac9d395b56a2e8552925d0f09c785d89e876702c96b75963b1034488a3ca3a6de4b8701355652b528a8ad2145cb2ebfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333046, "uuid": "250d480d-fe72-4186-a4e7-03c74f480a5f", "value": "T1BD14D81A9F510FFBDCAFDD3701E90A0235CCA55722A83B353674D528F54AA4B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333046, "uuid": "f8741cdb-aa0c-45c1-a167-78005c2880cf", "value": "3072:MaTlwOmuy3dhX8PwSZONIs+FWR+ZpdLARR6yI8tji:5TlNmncwEjs+okpW/FI8tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333046, "uuid": "590f702b-c753-422d-b074-b7a2adcc98ea", "value": 191220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333046, "uuid": "e2523adb-c3d2-41c1-863a-477149f2521e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333046, "uuid": "b7210f7a-0d66-42e7-837b-377d68751bb2", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410a0a61-8b86-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785354415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354415, "uuid": "44c72ce3-eb6b-4290-aee2-ed1c0ed9c860", "comment": "Malware payload", "value": "982a04e87ee9784ae34a059f94e13c47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354415, "uuid": "65055f6f-3aa4-4860-ac3d-64e55a4c911a", "comment": "Malware payload", "value": "f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354415, "uuid": "d4933acd-76e0-4c87-80a2-3ac6d841ec16", "comment": "Malware payload", "value": "143de44afc38923c93a7d3c312c12e98378ac7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785354415, "uuid": "97059597-a621-4a63-b0bd-fb065d574079", "comment": "Malware payload", "value": "fde48d1911c7e7eafd8f321b8a39c8f8f19538027b13d2a14f6a9d01e85eb22deee918343bac0fbdfcf44bcf881c245a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354415, "uuid": "646f2d5c-886d-4280-911e-b961ae28a442", "value": "T1AAD46B5238D514DAC13682F2CF93E1749713FC781DA4852BA2CD2E165F0AEA12D63EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354415, "uuid": "e9ce8280-d357-4d54-bb4f-a1c9bbad5bc5", "value": "741f0bf68a28ce3a873985d135617016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354415, "uuid": "94309cbe-3d68-4191-96bd-a2ae6b9a8639", "value": "6144:I+Dh1PrCbTsyit1xj8niAhoDsAiv5pTGBNN9hR5wKHqj6f3rdJhnt/eGWv4r4BMF:I+d1TrtAiUXTsN9hMjsLeJMqj4zWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785354415, "uuid": "46549258-29e3-4405-a37e-a969e2e52ebd", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785354415, "uuid": "38fcdb8d-f4f1-4064-88b7-0ee8663f4687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785354415, "uuid": "80b72f5c-2f57-4de5-9c04-45549770ed48", "value": "f552f87811e0ac4c6757926e79bbf3a38fe6648634aaadb5a01f6e87e3a4951a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962a6583-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307314, "uuid": "fe1b2ea7-c7b0-4aff-87d6-f09691d19fef", "comment": "Malware payload", "value": "a960961b795c7480d4ad2ab22c0dcd15", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307314, "uuid": "ac4fef69-5650-44ab-8b87-fcedce7b42f4", "comment": "Malware payload", "value": "f55843bdd22319bce1d57b5a11d25b2da4e37b0db1896bd8409a0ad5cb1c2d30", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307314, "uuid": "5ef1e503-5afc-4d46-8a24-d136079ac699", "comment": "Malware payload", "value": "ef6220712ca33458ddbf6f7917233a2d742b15c8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307314, "uuid": "15dbbb59-18d5-4d24-92a4-d6ca4a81707f", "comment": "Malware payload", "value": "069959533da06a04d5989258ef2d22c9faaf1904b609b1208bb1a5968b803a86be23e3eb695231ea5f381279179e2c2a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307314, "uuid": "f3a175b6-6e4c-4679-8015-152c25f5c4ed", "value": "T1BB42C0165652F873C094F1A4FEB64F769207C491BE9780B715F4AA9D37B3855F01B10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307314, "uuid": "ad0d7641-0bb0-431f-b1ca-24accd1e5ed9", "value": "192:jqsuDKIaOFNHzvrUWx9WvBGT2AAxaS8QNnIuc92kBJQ4Zfa76as:JuDKKNHzjUWx9WvB11kBJQ4ZS76r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307314, "uuid": "23dc0781-2b5f-4ace-ab4b-2bc4a862a48d", "value": 12102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307314, "uuid": "dcc9734a-5896-443b-9607-a8630ab447de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307314, "uuid": "16745e6f-c208-4a62-b523-a3aeea931906", "value": "images_20260728_152247.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3725edf-8b18-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785307363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307363, "uuid": "d401e207-f68a-4b3c-8c05-27d19c98dafd", "comment": "Malware payload", "value": "2d71c7c818eab296fcc94299bb0ae19c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307363, "uuid": "fe8b8363-311d-4a32-840f-83bb66eb523b", "comment": "Malware payload", "value": "f5fe841a98f372eab1db20a33a15527a637faecd8ee6b3da8c5bc488a1f2e7bf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307363, "uuid": "0f3f7fb8-2dae-4dae-87fa-10eab8d0588c", "comment": "Malware payload", "value": "2831c22803037a78ade5a64e1fd471cfb93cd5c2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785307363, "uuid": "f2d567c3-34df-4e21-8704-c2b81ba2cb9c", "comment": "Malware payload", "value": "b1e2668f1dcfdfbdf2263a9258df770802a4a61bfecaa52f19eff92df72794f3370312f349626cdd0485dfc871b97e47", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307363, "uuid": "9de1529b-6edc-421d-9201-18adb956d259", "value": "T10A02AF9A100B9416EFCEA634315D4E5628C76B72D9F042A4C5DE0FFFC3DB960CB55858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307363, "uuid": "ca09eabf-1f8a-4de9-a691-6ba1c29b8345", "value": "192:nZGLC3sdagd+0WDdoKuMIxastCXJU7Vk041oEJ4:cCFgd3oeKuSl5UJk041rJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785307363, "uuid": "0aefb015-d78e-436e-a840-32dc3c898cd3", "value": 8452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785307363, "uuid": "a32ff61c-d026-4068-aa12-fc6a20e123d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785307363, "uuid": "8685d7db-eb1f-43b5-a610-8c55634cebfd", "value": "images_20260728_204623.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db704bf-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1785327351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327351, "uuid": "458e4f1d-bed2-4ca3-b2f6-b3a009ce612d", "comment": "Malware payload (VIPKeylogger)", "value": "f7fb31cc8b2a0be022168204bcfd91a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327351, "uuid": "8ba541ca-c5ba-4929-baef-3a6fbc120d59", "comment": "Malware payload (VIPKeylogger)", "value": "f68b0ab0aa45a9119c1a097c4d64dd3250733f771b34cec0699e3f9a7c88d79e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327351, "uuid": "ca1c8387-43d6-4ee4-a4f4-e521f2670a72", "comment": "Malware payload (VIPKeylogger)", "value": "bbe3b65bfddcacf116b310acd312395ef2d6b54e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327351, "uuid": "5a3cf640-14a5-4451-8b51-d98fcbf6ac68", "comment": "Malware payload (VIPKeylogger)", "value": "bd28dbb98e1612c8c98196a1a76d7a1668f662d233889760aaca13cba3e6e8d24f5a723b01d33a2cab95d9684a633342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327351, "uuid": "aba927af-e6cf-4bbe-929e-d5dc7340b88c", "value": "T128C42312EBE0D8AAD4590973CD3263F7CAAEAD61D3284A8B47457D487D71383DA1F381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327351, "uuid": "67dcc5e6-60ff-40d5-b5b1-6ed1deda0e57", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327351, "uuid": "ff6a59cb-bc73-411b-913e-06c6ba7938dd", "value": "12288:AfYPo/gfgMUCPvcU8bLqd3sqItJSfgpf6DtdzfW9+:AfYPo/cgIH/8/qdGTpat9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327351, "uuid": "b39d639e-ba45-473a-a5a0-0710897c0182", "value": 588976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327351, "uuid": "0980db95-f3bf-4cd9-b615-f81e09eead1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327351, "uuid": "2d6b4f12-1d85-437d-a124-dcdb23866555", "value": "SWIFT07282026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bc22bb-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (BillGates)", "timestamp": 1785333160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333160, "uuid": "0a092f78-32a3-4a5b-807d-d73fbe8deec9", "comment": "Malware payload (BillGates)", "value": "b24ad373f89afec451b3cc8bf8ed66f7", "object_relation": "md5", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333160, "uuid": "b9bdbfbf-6a8c-4d48-b033-d017bbb32240", "comment": "Malware payload (BillGates)", "value": "f6b23cd237e6eff4720e9bb1835113b04735092d556dbe89f93a4099229ef77e", "object_relation": "sha256", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333160, "uuid": "2e188905-5d91-4718-9c39-1e6fc752148e", "comment": "Malware payload (BillGates)", "value": "c05dd943d733604fa6bd6a9db1dd0e618fd39303", "object_relation": "sha1", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333160, "uuid": "03ed2b61-7eaa-4324-b70b-4c3419bf0305", "comment": "Malware payload (BillGates)", "value": "1cbe846b97667c1899478c99c05dc23d6569f3999f148fc4ab03404cc46d9a40822ccc4516eca2010531cddf636ce905", "object_relation": "sha3-384", "Tag": [ { "name": "BillGates", "colour": "#712550", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333160, "uuid": "ef597de4-dbda-4af1-a625-43004c3190e9", "value": "T13B456B12FBD0CCB1D84616F5100FDA35D5229677A01BCA4FEA5DCD38BB29181AB1A37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333160, "uuid": "100f4783-06e3-469b-89ce-debf06ee5e8b", "value": "24576:e845rGHu6gVJKG75oFpA0VWeX4X2y1q2rJp0:745vRVJKGtSA0VWeoGu9p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333160, "uuid": "1350576e-3149-43a7-9f80-29b07b4bc874", "value": 1223123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333160, "uuid": "7ee94f59-d314-442a-8c11-9de13684f681", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333160, "uuid": "b37b22de-1dc9-4f5f-966b-b88d1716b408", "value": "syss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62010844-8b0f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785303361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303361, "uuid": "3ed5514e-8243-4321-9748-4f910fe82545", "comment": "Malware payload", "value": "2ab3cb611100a1959c5cc2e1ca973d82", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303361, "uuid": "2d26d6ba-c06c-4298-bbfa-3a90d7eab112", "comment": "Malware payload", "value": "f6cf17d3a2fe9d4e4091aba37430ceb55bd43a7c741453b50fae7bc868f32994", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303361, "uuid": "a8f00b50-01d7-487a-9ae9-1e57da4e5a43", "comment": "Malware payload", "value": "d58f25f9c045f1bd0bf5aeff7248217c62465257", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785303361, "uuid": "27faade9-3861-4359-926a-e76f3f863eb0", "comment": "Malware payload", "value": "1524db12386c73edfe36e30f34710ca2cae2e244d5341b027c97dfaea4252362998a136d47530c0b4b5f675a47fead6d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303361, "uuid": "9cdd02bb-21d7-4e37-a3d5-d699a7af3be6", "value": "T1AAC4220D3AD0DDBBC2538C351AD5D1AB1052BD12EF26C65B32E47B0D8739BC48166EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303361, "uuid": "752065e5-bb4d-430c-9d2d-9804511cf454", "value": "12288:YP5Eg9oEhTylNWk2lU9fO9G17072IPgl+PDhJu1KM:iqJll9fOM170qIJDhJu1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785303361, "uuid": "7887f9c7-e6ba-47f3-9d2f-ceb7f9dd64f8", "value": 548864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785303361, "uuid": "435a8673-5306-4a12-9df0-cc3af3025000", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785303361, "uuid": "c09bb308-a318-4ff9-9654-d28aa39cec4f", "value": "T2628-7.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f06260c-8b09-11f1-bd95-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1785300779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300779, "uuid": "a89cfcb0-3d1d-4630-86ad-a216bff904cf", "comment": "Malware payload (RemcosRAT)", "value": "38d4819e0e90938dea25f3a70b0f90b0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300779, "uuid": "14dee3e3-90bd-4f4a-9619-824bdd0a3315", "comment": "Malware payload (RemcosRAT)", "value": "f6f96693b00e3afd241efb078650781eee05c0e38b0f41e75e04f4672dd4fc48", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300779, "uuid": "b7cdad3c-983d-41c3-bafc-7c97b5535ef9", "comment": "Malware payload (RemcosRAT)", "value": "ac476a8c0ba413dc4b306cd16ed16079367aeb06", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785300779, "uuid": "ee541d33-bbfe-4e71-bb3c-d1a5ddd6b626", "comment": "Malware payload (RemcosRAT)", "value": "b182894cee6e35e6b741df75f3bb8c46ed1f56ea2e2622091d34f4afdabeefb9035f70e3af0eb0a90e824443aece74e8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300779, "uuid": "1ade1167-52b7-4ccf-b70d-f9598ade3dd9", "value": "T1A3441820DCD80B3A0E57079DFF510A65C9FDC629863790ACEA9E172E50135ACD7BF268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300779, "uuid": "a9a8bf3d-0849-4f1f-b493-8576849d7372", "value": "6144:FupxvdhX5j+HWBlaJNpXeRhGN6ovRf2aYzTI:iDj+HWCDpGsnXYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785300779, "uuid": "2b0ee98d-3d4a-486f-be43-d419688b590e", "value": 276595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785300779, "uuid": "7ede1dab-03d2-4a10-bf5f-3f82aeb0724c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785300779, "uuid": "d9562231-6fb4-4099-8079-0d989395816b", "value": "Shipment-Advice-000300499900-pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "532a9cb4-8b14-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785305483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305483, "uuid": "f57e9ae2-5406-4973-bddf-93c8af26747a", "comment": "Malware payload", "value": "6cb4f6ecc5aee198a2ab46b7f2086a68", "object_relation": "md5", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305483, "uuid": "dd36e987-b7c3-45bb-b84f-5a4fd3beb079", "comment": "Malware payload", "value": "f7f22ac70966c2205281f63c80e603952a23d1e41bbe98baf0d378e64ed0c3ae", "object_relation": "sha256", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305483, "uuid": "9af0c619-7cfb-42b8-a521-c8f8b905e95d", "comment": "Malware payload", "value": "fe5d5cf182052fce866f19e5b1c5c0db658544c8", "object_relation": "sha1", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785305483, "uuid": "95b42f16-5c94-44ff-852e-8992d9dcfce9", "comment": "Malware payload", "value": "0ed814610c2d20f5b9098d6e487f63685bdcaaaffc9603060d0e835c47597fd3744064019083e782fbeaf25bda90d518", "object_relation": "sha3-384", "Tag": [ { "name": "37-148-161-44", "colour": "#A43772", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305483, "uuid": "28fd66b9-29c5-4cbb-8c21-60bb8f4f6290", "value": "T15672C05BAC79265DD00BDFD2FB61917855AFEA94427345DA24C3470AF4323BCFE82160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305483, "uuid": "28b5ac78-60bc-4e8d-a572-07b669bdebf9", "value": "384:0K6tFStvBld0eSl/v7zxlGS9pPE/OSufqRUvvTIU+V:nN7d0eSB/779pPjScqR6cUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785305483, "uuid": "731c5145-a726-463a-ab62-bdbcae86c61e", "value": 16091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785305483, "uuid": "f5dbf82f-490e-4bfc-a10d-9160193fd098", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785305483, "uuid": "b8a71728-0449-44d1-9daa-2318acbb8f75", "value": "WJcugJ.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19fd4eb-8b38-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321103, "uuid": "84dcb2f1-7355-4ecb-8d58-376ddf1a7390", "comment": "Malware payload (Stealc)", "value": "25774b9f2918cb30364298716f64b014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321103, "uuid": "36d07f81-d3b4-4f1d-9893-8bfae641e17d", "comment": "Malware payload (Stealc)", "value": "f901e1a138129e819f4759f30102e94a9987409f0978c9505c2d679d1a0880e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321103, "uuid": "11109812-1f50-4237-b293-4bd79dc0f043", "comment": "Malware payload (Stealc)", "value": "6459d9f6ed1b29258e53b9d621ce36fc504f7b18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321103, "uuid": "e7115113-73ac-4179-a8df-959af45bca4f", "comment": "Malware payload (Stealc)", "value": "5a551706fda1d256e9332cf865bcde5997dfa09fd4fb5a7c926d6c9694797b6cf81a3b3b4d713f4e27803e75e99c862d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321103, "uuid": "45d47e29-463c-4140-937e-99398652c3fe", "value": "T1A4059D1AF7A502FCD07BC174CA424952EB72BC565330A69F03E15AA61F376A05F3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321103, "uuid": "daaa2d32-6fce-40b4-9a09-87f980a554f0", "value": "c55db45c7490f797b5558c00406832fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321103, "uuid": "695696e8-c10f-4d14-8988-bcf8d3db26b3", "value": "12288:ECHSXamiqz8hbhvbTOMfJr6EmnEM8yxBlDetAqxSv1Ec:0akzubhvbCCJ+pEM8yb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321103, "uuid": "7256121e-881f-4a84-9ef3-cdd39647935d", "value": 860672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321103, "uuid": "46aa14cf-1a61-4098-b3ea-e3ca414ae068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321103, "uuid": "ddc415ce-58a3-4edc-99fb-68d894b8476a", "value": "f901e1a138129e819f4759f30102e94a9987409f0978c9505c2d679d1a0880e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8144eacc-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351517, "uuid": "c9d2a51c-4ca6-49f9-9cc2-aebe15fe1948", "comment": "Malware payload (Mirai)", "value": "4cddbce2c1ffeb1c35361328fa721c14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351517, "uuid": "facdd2e6-2f86-4bda-9db9-53414c872dd1", "comment": "Malware payload (Mirai)", "value": "f972397ca82b604efdbc6041bbb1a435500cf37206de9973b21f8632433ad243", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351517, "uuid": "d7dfe2a9-4227-41b6-8130-d17cbfc42407", "comment": "Malware payload (Mirai)", "value": "e1bf97b10d78b142f9db90ec8c13aed0c0801bcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351517, "uuid": "1a9b5503-0ea4-4574-a334-3950e140ceec", "comment": "Malware payload (Mirai)", "value": "d11af903a9cd00eae459e3c86d0981d98b53aec58105439c2217f96900a0aaf3dd85ae1bc521fb357d0acc787895acf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351517, "uuid": "98e72410-2151-4b3b-a313-740d0180b8f4", "value": "T18543F182824C3F12DAF4353FB0AE894677314534F42A95665604E7247BF21F97AB4F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351517, "uuid": "2ec16685-98fa-48ff-8084-9d719743b59b", "value": "768:bufijwnGd9fo99PC9/2xrCqS3xtVOfr06aqM7z8KBUrfl8WQW8APon/bqakAOSqw:6tGLCgs3SBHOxpM7lUrumW3hqU6eJdfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351517, "uuid": "a6002daa-793a-4711-b943-a035deec943b", "value": 60256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351517, "uuid": "c9000550-2829-4c9f-8177-bbc6fcb794dc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351517, "uuid": "57a40ffe-6f8a-4ec7-80c7-25e33f7747c7", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399e124d-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327345, "uuid": "6d1658c3-be87-46c8-a345-358e16ce96ca", "comment": "Malware payload", "value": "8a913932960ebdc102af92254751d7f4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327345, "uuid": "d6e6595c-3861-495b-990a-b17c55ec41a0", "comment": "Malware payload", "value": "f9aeeb9bb1315d531567b1fc291d462399a46bd61f446c8a9a6c1bcda592313f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327345, "uuid": "56cfa368-7968-4481-82b4-1a11158ec2a1", "comment": "Malware payload", "value": "5689c301e8d17fc0fba1beda0588badaf70133fd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327345, "uuid": "04fbb632-faf7-4588-b08a-d31ae8ed9b15", "comment": "Malware payload", "value": "e4e4f3c96cd761807454e8df1fefd94522ad2aecc3d5b888f2d456b75d95577d9105268297fa04bd407378a090e33ed6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327345, "uuid": "04a225e3-1bd7-4a93-a858-6a26f81ef330", "value": "T1084423F9F4AE4502E14504D090950B6C4BAF7FA0D287587DE87E9D5C230EF19E68AAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327345, "uuid": "6214f325-b130-4104-b69c-6e2171862b35", "value": "6144:VPoI2RHI8j4Gp9/C2dbHHO8qdnNtD5P848AW7kIh:VPoI2xrp9Djurnvy48AWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327345, "uuid": "3fdda7bf-1816-4c1f-b00b-1fa171e22d27", "value": 261756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327345, "uuid": "ab5e85d7-326a-4d2a-b84e-4bab37807d61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327345, "uuid": "6ce8f985-a6d5-4957-b43a-1196df7fb0fd", "value": "DOC07282026.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f58693-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333036, "uuid": "95f33e64-0b24-4e3e-a328-789d1d9c9ff1", "comment": "Malware payload (Mirai)", "value": "eda730498b3d0a97066807a2d98909f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333036, "uuid": "1f76b29d-8e97-414e-980d-4d38180676a3", "comment": "Malware payload (Mirai)", "value": "fabece475f5a63d9c58ce5f7fb1f8d4e9c7171ac5d603b7b1ec31b0932008cd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333036, "uuid": "8f4f4887-087d-4a54-b8e1-f63cfd57e6c8", "comment": "Malware payload (Mirai)", "value": "0c1af66757c6a0390cd190a14f9430aee2f0ba6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333036, "uuid": "96c568f7-7a34-4752-b965-afec5b55c70e", "comment": "Malware payload (Mirai)", "value": "60ec391aba5c346ba542804d1cf3641c39cdbddd3cec44f77d08d320f7075c1a0012ab3bbcc9ffa6babc0f654b380061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333036, "uuid": "78149ebd-00f4-4618-805e-2070c82532ff", "value": "T1A4445B83F941AD12CAC12AB7BE7FC2CC335707B8D3EA31169E115F64778A4564E39A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333036, "uuid": "c6107edf-f0db-4968-a4de-57bf90bee7c3", "value": "6144:1otKHAPn4iiXbrtxXU1AAV65fmET4DPqO1:uxn4iiXX3UaAV6h3ePqO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333036, "uuid": "92920a2d-a76b-457f-b5f3-cd9baab3811e", "value": 277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333036, "uuid": "089ca2f8-6797-4891-bd32-c65fa8075ba7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333036, "uuid": "cd1eb8fd-6f10-44fd-963e-7aebffea5025", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838435a0-8b7f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785351520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351520, "uuid": "49f7ac7c-9697-4036-9694-233a7871173e", "comment": "Malware payload (Mirai)", "value": "ca63437040c175808f61a72e953190a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351520, "uuid": "e09940d0-b5f2-4d4d-a884-99fabc3b0f01", "comment": "Malware payload (Mirai)", "value": "fad48e2d29e539c4beb96e8e1d7367b53f14f73613ff97628152de8f910a74d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351520, "uuid": "85920f82-da6a-4ced-bdd3-604fff4b4152", "comment": "Malware payload (Mirai)", "value": "bfe38b1dc1dd139dad56f3fffc55d70e00b44a99", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351520, "uuid": "10274768-7d1c-48e3-8073-86366cde2e8b", "comment": "Malware payload (Mirai)", "value": "b515a73f92ef1910241b53ea94450bac2c8d2529747ca6caad317b8e59263b1f2dd8272f0979575de934c43b95fffb1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351520, "uuid": "9a4c3b27-0993-44a7-a316-01a3b3e9a56a", "value": "T1567302695C8E3866C08013BB96D5CBAFA1053B663DBFC683CD20D2429CF5C97D72B01A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351520, "uuid": "73396470-a33b-43cc-883a-6f51699ed53f", "value": "1536:4JMSmfkaSCcgO8h0PwpK40wHV4zAcIjckhwuyljPsKPHMY07rSgSQrk62:4ySmfKC6c0Pww3wSsV8PzsY0/S+Y62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351520, "uuid": "c82f4cab-82a3-447f-b041-f1c10b7516c8", "value": 75864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351520, "uuid": "ff0a6727-ae48-4864-967b-9421eba1e588", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351520, "uuid": "8a6fcab0-bee4-465c-92cc-2d74a5030bd6", "value": "zero.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29b7471c-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323882, "uuid": "afe24edd-5b2f-44ee-93aa-e8e0d9c1ae99", "comment": "Malware payload (Mirai)", "value": "6bdaca26ac06b6419deaa8ae4b5c9b1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323882, "uuid": "fa059151-11d0-40ea-b8b5-df79af7b97b1", "comment": "Malware payload (Mirai)", "value": "faf3988b8f6dc690efb46aae98efcbe47e489958759e0dc60cb697019fe69e81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323882, "uuid": "a80c1cc7-9ba2-4d3d-afa4-4e977c71864c", "comment": "Malware payload (Mirai)", "value": "13d81196fcb1a2c657d26d6b0a3746d7ebe31d21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323882, "uuid": "abbb9268-f862-45a3-aed0-ca54c1f7f3bc", "comment": "Malware payload (Mirai)", "value": "efc0751ae7221a9f92f21db765ec4776023413bb76d61a4e09be456d2e6dafbed77127a76d629a773e2147c02c94b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323882, "uuid": "46374391-7778-4861-ad7a-ada4985a6ce3", "value": "T1C7934925697A2E17C8D4A23E11F78752F2F5370E24B0C65E7D760F8EFF14680A5462B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323882, "uuid": "9a1300f7-9f8e-45bb-b2a9-dfaea7eb0200", "value": "1536:b4BL6tT+Lr+caVNbX4ShVYHfBRHU3U3TnJVL97/F3ZaO0+MM:YLCTnv/xHaBR0k3TJVL97/H0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323882, "uuid": "5653fbec-7609-4887-88e9-72b73681dcab", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323882, "uuid": "0e8bbe6f-ff8f-4db0-bf1e-0e6a7a0af88d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323882, "uuid": "a39dcff1-c53f-463b-a5f5-0ad4b5c68c56", "value": "MMaaRRiiOisecTanee.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c35e5a-8b3f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785323870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323870, "uuid": "a2ad08e8-8ed0-4bc5-a488-0e5fd7c40187", "comment": "Malware payload (Mirai)", "value": "7110c9754ec8bbd523f6a5a5f0413807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323870, "uuid": "2697f2f7-5f21-4e8e-9aba-37f1f15cce71", "comment": "Malware payload (Mirai)", "value": "fb5c18b832e23448d78e7b2542579d1c79362636ab96b5299052614166d4e3fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323870, "uuid": "3d4f6b27-24b9-4aa0-ba54-24618827b4c2", "comment": "Malware payload (Mirai)", "value": "e2b60de8d98b92806d68615d23753a54ae38ebc1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785323870, "uuid": "08effaf8-44ef-4277-85fa-97880543cc48", "comment": "Malware payload (Mirai)", "value": "5793e0726f45ad1516d87604b88d59040434b2027f9468964b16d38f11d3f9ab2bdcde4e35e27853ffe8b15de2f97d74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323870, "uuid": "1b06b724-6b9d-477d-a900-68fad5eccfc9", "value": "T1E4B3950E6E319F7DFBAC823857B78B219209379626E1D584D09CED025E7038E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323870, "uuid": "59fcfca4-9e4f-48b1-ad62-5479a6983c1f", "value": "3072:er3x+xpNAsh+JySL/BjtuLdkPpl8eNEXkV:ex+xpCshOySOLdkPpl81kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785323870, "uuid": "f934bcf9-d312-41c2-b0e2-623c877bf4e1", "value": 112980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785323870, "uuid": "1832e10b-565b-4631-b80f-d1902d780404", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785323870, "uuid": "fb0468e7-5670-4525-9f76-3b7050f020af", "value": "MMaaRRiiOisecTanee.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e183e99-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324426, "uuid": "e6f7f63a-8541-4481-a980-aa7ed99c7469", "comment": "Malware payload", "value": "332b1745cee6c5cf847600c9b9e0b3c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324426, "uuid": "7269e37c-446b-4718-89cf-d5b4f4374217", "comment": "Malware payload", "value": "fb627d67b5a9b670871c45703f6ccf7a0514cb0027e6f8a67039a6ed9cb3adc1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324426, "uuid": "a3b98441-7033-4582-8f6f-fa9983bcb804", "comment": "Malware payload", "value": "de815bf59f2a5317fb9673cacf9ef63205e6a267", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324426, "uuid": "c4a0599b-6875-40fd-a20d-b6a9a485893e", "comment": "Malware payload", "value": "73a01193415383ebd9d97a4c147c1fc2dbcff27a2fb020f9b5d13bfecc883c872fd9a5993b3e3b2b6023e64536f6b738", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324426, "uuid": "5a0a5c94-a142-4a9c-a742-bd9114edc387", "value": "T1FF21A7489168C7C0C84D8A36BD84D85CB8295D7C514FB77173F605F8332BF8D9A1158C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324426, "uuid": "2445155b-8e9e-48d6-8d22-b05c64636ff6", "value": "24:9JQI+yYGcKthR4PouhlVxkRtyb2mki3A4P/OINolI9O4RY:92yY8R8VhHuC2Ti33ZoUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324426, "uuid": "8e4374a8-c1dc-457d-ab30-817d8d157cf4", "value": 1244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324426, "uuid": "b165cfcc-4cea-4e72-8c52-51dc01e5c159", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324426, "uuid": "214c10c1-5186-400a-a225-c386472b281a", "value": "photov_231356385965.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c120c82f-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785333155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333155, "uuid": "8dc2f4ea-79aa-4a89-8726-5dcb1ad01578", "comment": "Malware payload (Mirai)", "value": "8bd22731de1f8f5c69e1fa8d97d24f5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333155, "uuid": "1becd4ab-14c5-441f-a5b4-9be594373af0", "comment": "Malware payload (Mirai)", "value": "fba96428f3abad42d2d2d3fc732d5a7e0f0bae85cb818bc2db86c9c6cc8177ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333155, "uuid": "4eade6b1-1ad8-42be-831d-604392c53848", "comment": "Malware payload (Mirai)", "value": "477da80367be9ff8a2ec04ec6ca80213d6de771c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333155, "uuid": "43b3c8f9-f09f-4971-8a7d-bfc69fa72e82", "comment": "Malware payload (Mirai)", "value": "8c1b6ccb92affce6343447a223e66e4d1d4200148c584aeb1d76a42e189d1bd185d17b8f7330905096a5aeea0b0c75f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333155, "uuid": "2747385e-ca1a-4107-b388-c4df28d86573", "value": "T1A2446B137A8184BFC8C7D2F48BEF92369832B85E5536724E27A07F512F49EA06B5D350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333155, "uuid": "5018415b-6445-4af9-ac8c-29ddd9983b55", "value": "3072:vNlZwkFIdqqUPRgqlT2FfnzgHOcVhyY6T8WSepsemGd1C1rfzIibFd7m4kgOboDq:vN7wtwqUPRgqx2dZphxM75jq850G7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333155, "uuid": "62897572-f0b1-433b-91a7-e25c980a666c", "value": 253464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333155, "uuid": "c6165e52-e007-44e6-864f-6821b0189427", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333155, "uuid": "d15533cd-f9b7-41c3-87d9-f82e8e9fa5e9", "value": "BlahajNet.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "540252b5-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327389, "uuid": "f887d521-9ae6-4808-a130-58ace6555a3c", "comment": "Malware payload", "value": "45cd133f01f4d2808f4db3e6583fee34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327389, "uuid": "6c827362-d1d0-4bed-b3d1-21da3aa48730", "comment": "Malware payload", "value": "fbc2b2bc5365528b68b60a150e85407c0f51952b95c272ac7d85714fd1e0e8bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327389, "uuid": "b00610ea-14fa-4a71-98db-a559d261c713", "comment": "Malware payload", "value": "646416740aee40accca6d0dc2714f89adc03f5cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327389, "uuid": "9a725d26-2b68-4d92-8f74-c0461a0301da", "comment": "Malware payload", "value": "02b67e35df3a7dcc20a0774649599d9347afe1e2b212bed7d08d46ea15d2b686a33f1eafabb455f020023d64827c4a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327389, "uuid": "87a64f05-6569-469b-ad9d-4938b4cd90b3", "value": "T16D749D63227408FBF2A150F6C99217D19F6EE8D1FA217A5BCF4021C56DA37B05D782D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327389, "uuid": "cd90a09c-065c-42bb-a958-144f84d76407", "value": "0155aaee1605b1b3fed6715ae13c1c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327389, "uuid": "4e0a7650-0c62-4b8d-a614-21f48e846870", "value": "6144:T9KD9F9WqYw86qRsBCldwAxXgg/96MaBBmVwU87CVb63vZ3AK3OQqZeCXtdB:BKDtWBQYdldwMQg/AMaBiih/Z3AK38t7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327389, "uuid": "21e0123e-fa4d-44b8-bdfc-051c5b664b80", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327389, "uuid": "ef5825b5-f26f-4d10-906d-7b525156f3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327389, "uuid": "060f7c6d-9394-441d-a0bb-6d3599310772", "value": "fbc2b2bc5365528b68b60a150e85407c0f51952b95c272ac7d85714fd1e0e8bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45816901-8b47-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785327365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327365, "uuid": "9eca5114-1058-4a9f-bc99-53656b60417e", "comment": "Malware payload", "value": "5f338809e1174ab79e5063ccad569ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327365, "uuid": "c2b29652-c0d8-49fb-bd39-08d7684ccf68", "comment": "Malware payload", "value": "fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327365, "uuid": "39debb34-a3d0-491d-8815-13b6bcc45ef5", "comment": "Malware payload", "value": "e7c10454339bfcd3e7f35183dac4c61e642f848f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785327365, "uuid": "9ac9a528-c6d1-4841-bfbc-cc0598589dfe", "comment": "Malware payload", "value": "0bde02880cf555fe97c4fc84dae815731a8a488dbfd1b5f04ce56cd7230d96eb15dee695a96a33920fdfaadb3a7e9179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327365, "uuid": "48907edc-a8e3-42f9-bb64-c5ac9fcdded9", "value": "T1D574CFD5E75134E5F25B89708EB34F4396223E0F8A21D27B1295450FAE63FC61E34BA8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327365, "uuid": "901d89c9-11a4-4b13-a144-4a9f82150268", "value": "cc17bcc7fe575a59b90e88841fe76dbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327365, "uuid": "f1a1b1ba-6a86-43c2-b93d-0b1da86f51a5", "value": "6144:/6gK/APsjrh+9bETi0zMThBjH5RNLBFwCJKq9RKa6wVF1u1+gbu11MUrjFzNLWWE:yg8jrEtmiIMThBjHdBFQqjK2VF1uIPMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785327365, "uuid": "598ece4d-15c2-4539-9802-bd35a308ba6d", "value": 355328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785327365, "uuid": "3f13a209-df5a-455e-b931-46d6fb7222db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785327365, "uuid": "15f825ef-c716-4b61-ae1b-e5c85babdd1c", "value": "fbefbd142aa9e842754ad914e9a3b14a60129fe8b9863db23e2c8c697b5923aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d4da15-8b27-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785313863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313863, "uuid": "4bdde66f-eada-4154-9f01-20db1f30e400", "comment": "Malware payload (Mirai)", "value": "9b2bf6bfb0e393d9df38088bacd7e58c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313863, "uuid": "f886d018-b0c1-4a7b-81c2-70c47ae1ed9a", "comment": "Malware payload (Mirai)", "value": "fce803738319874f83444c378945937195738bc12498d3e8a848fa3c6593dc39", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313863, "uuid": "c5060dc6-50fa-4165-ba10-ba468a1d8e07", "comment": "Malware payload (Mirai)", "value": "5a50d9f297c25d6083bbaafbf5de48c2a91af079", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785313863, "uuid": "fbf02962-7304-4ace-8ea6-8ef2a5982cc5", "comment": "Malware payload (Mirai)", "value": "2db2aa0d966e85f73c0be718b2a4942b65e7651c65ad7ee6663cf0bce991a715b2cdfde6bb7360d9132ec8ffcb8e1dc9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313863, "uuid": "1ef29529-5f70-419e-bd4f-a4c9f86f88b4", "value": "T187330980F98785F4D8139C30806EF33FDF70E93A80B1A69EEF499E75D923642561268D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313863, "uuid": "e04510f0-fadf-4270-a8b6-62c0e4ee992b", "value": "768:wmovnHOG+M/5RfIh5cRqme2GePokvVvQ2Zt1ujWIBgr81:lofOv0Ih5cRg2Gam2T1ujWIWrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785313863, "uuid": "75d8fa2e-c6f8-4133-8fba-1f000e05e15e", "value": 50964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785313863, "uuid": "b2b31348-ab2d-41e7-9bee-79bfd17b1dec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785313863, "uuid": "0c2893b0-13c6-4cbe-a103-bb62cbee0672", "value": "real_i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66e93f18-8b2d-11f1-bd95-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1785316254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316254, "uuid": "d92d7aa2-4687-492a-9ddb-ebc9c8cb67ec", "comment": "Malware payload (SalatStealer)", "value": "fe2d63e6c7d907019e44bb4a2138b236", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316254, "uuid": "b08ca249-53e1-4996-9d65-1afdb0d76cc4", "comment": "Malware payload (SalatStealer)", "value": "fce8ba975afa37727c61a9940c81c8e20da1de724f8a10b44b89d7ed44d7f526", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316254, "uuid": "9a0c048c-b3a4-48d2-b89a-08656017c991", "comment": "Malware payload (SalatStealer)", "value": "90b30f19d6dc61e4c84539324b839f4fec0b4814", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785316254, "uuid": "9c645cb8-df05-464a-ae23-c7576cf58547", "comment": "Malware payload (SalatStealer)", "value": "ef60e10fa2be8fc1467ea445a2c4fe37c2e084ef390b554be85cae688dee34d3da0a8ec63a350460798b13166fb0398d", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316254, "uuid": "d11ba07a-75ba-413b-b473-6733648d8828", "value": "T19EF533D4D9D7012DF5900637E6A8B7037F5491AAB2DDCB90EAB930EE5A8A790C30DC1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316254, "uuid": "8cab43f3-c1a1-45be-af43-6ca8fd3619ac", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316254, "uuid": "2fea9690-c028-43b9-913b-23fa8a278ae6", "value": "98304:ZpK3fG54NZ5ZstCuxZsvA13jKEG5aeL2pkRq+l1kaIhb:X+sICdmDRLpRq+lOaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785316254, "uuid": "9659230a-0aab-40f7-be60-215056fbaaca", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785316254, "uuid": "2b4c2efb-148f-4df0-a857-6ebab7a9c6a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785316254, "uuid": "bae340ae-45fb-4c71-b30f-72d035b773f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ab01d5-8b54-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785333161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333161, "uuid": "634a0593-287b-4742-a3c3-c2f01a41e6f4", "comment": "Malware payload", "value": "215a41eb865a93817294a573e3fbd9b2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333161, "uuid": "8d2d8d0d-3ba8-49db-a83f-a21e0c98cee1", "comment": "Malware payload", "value": "fd3147e1b9394e7c063eb8086f82e2ddade915c4b5030d17865ff1a0e670488f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333161, "uuid": "e581ac1b-8840-48e7-85b2-ad388ec0e0ca", "comment": "Malware payload", "value": "81f4de90e8e382b4bac6823deccba19e151ae433", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785333161, "uuid": "a3e00895-25e5-4948-996b-f43cd796525c", "comment": "Malware payload", "value": "25a2a19a82491577d3d4063d3921db417d67d2f680be42f22aa9be458289d32eba4bc58413be5effd403516c32cf5ac0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333161, "uuid": "a2b78efc-6c07-4ba8-9bd7-c2326c74c727", "value": "T1CDE2D9B174099631329DEF2D18F5AC49A616718BF6204900F41F3AD90FFEB58FD681BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333161, "uuid": "7fb66223-9df6-4a82-9839-552b8000ecf4", "value": "384:EUl5Bo43w8FUFtFZFC6ygcaZW/o6aIjDNG:Ew5Bo43w8aXFZYI6ZjDNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785333161, "uuid": "cd711ff4-659c-4fdf-a64d-cf8518770b65", "value": 34200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785333161, "uuid": "432dc393-0665-4464-9e4b-e93c370150d8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785333161, "uuid": "340aba07-7c2b-483d-b5fc-93d1da61c680", "value": "raw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faca6036-8b7d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1785350861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350861, "uuid": "8aff1eb4-cf22-4dd5-ad50-a0a209e11b61", "comment": "Malware payload (Mirai)", "value": "d7fbcecd9d03cfca915e8202bfba0f6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350861, "uuid": "b631608d-1ec8-4e65-91bf-f05eb2745481", "comment": "Malware payload (Mirai)", "value": "fd6334c555b02f64adf35c06f120a6c650f7059cdbbba991123d76da29c31466", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350861, "uuid": "7d2a0d5d-18e3-4b03-a33c-62ed358005a6", "comment": "Malware payload (Mirai)", "value": "e3c07720d36f71f5b894b56c2e83a1eedb55183a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785350861, "uuid": "bcc51d2e-f969-4643-9af1-11f1e969f2a0", "comment": "Malware payload (Mirai)", "value": "f79a98b981e9221d4a0e401d5667cf5aee585b268070b518319dfb21cfb86ce44a3594238a0f2e2f25a5449c46432383", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350861, "uuid": "4d0bed00-6e9e-48d7-a2e9-99146bf0ff4e", "value": "T111C32AA9F880DE62C6D5267AFB4E418C33231778D3DE7105CE149E3467EB95A0E3E942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350861, "uuid": "cf2a402f-a81e-497e-9769-9851ee2c4dd7", "value": "3072:CON9L2wOtnosmfncYEEU0084WnCwlDBteiMALe++p95aA1Dz:COTAmvcYEEU0HnphBteipWbamn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785350861, "uuid": "650ce00b-2558-4bc5-afdb-61d506d53ce0", "value": 128460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785350861, "uuid": "10ad65f8-8cd0-4083-aaac-19ab8dad5a7d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785350861, "uuid": "a5e95bde-bd4b-4eed-b380-2ddaacd9f189", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03f4e99-8b7e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785351166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351166, "uuid": "bcf6f72f-077e-4159-8800-a2745845b0e2", "comment": "Malware payload", "value": "e63fc1b8a2fd320f7c45277de73f47e5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351166, "uuid": "2f7ab4dd-2e97-420f-b86d-76f35485acfc", "comment": "Malware payload", "value": "fe315afcc80b75d67aa937c4234c5a54ea15b27652f6b3607b0289ac52228051", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351166, "uuid": "70bc7365-b9b2-4309-96d7-b1aa52b449c2", "comment": "Malware payload", "value": "1f7a9e978a4fd4bca032a2eb4bec7d5ef565b790", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785351166, "uuid": "887acc18-6df7-4f90-9440-8a068bb98a2f", "comment": "Malware payload", "value": "6c9e4141ef6371be8f7703713edf7489f7fe3d2880c3ff40ee7e0fb0f04967b3a034b29001056f8d59c3610a38b6d064", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351166, "uuid": "98abbeec-60a4-4e16-8768-fa80fe6f0cc2", "value": "T1BAA67B077CE109E9C4AE933189B661917B75BC084B3533D72E60BA782F727D09D3AB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351166, "uuid": "12c7e36a-63a4-4877-b402-5059e92af361", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351166, "uuid": "72280d9b-1491-4b56-ad03-48a63e581529", "value": "24576:AFMT5xif6YM9T8kVMZTQvSkUj/HZwOQseSzrPkbpjO4OMMcs8DRZ+OlfzBele5ru:AFMtxC699ok0cvSkU5wuRPupjaomY7l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785351166, "uuid": "a384dee7-48d8-41ce-b551-0ef42a11831f", "value": 10412920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785351166, "uuid": "41ac0ae5-c6b2-4b51-ae8b-34e4d7ab5229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785351166, "uuid": "ad1b719c-21be-43af-bbba-8db98ff01d68", "value": "bhatta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12f43f6-8b40-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1785324566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324566, "uuid": "277f3f50-6e9e-45d0-8be6-b7424aad13c0", "comment": "Malware payload", "value": "6532666a88922ab5fae74327d2c0fec5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324566, "uuid": "3727b1be-0b42-4611-8cdd-2dad80e037d0", "comment": "Malware payload", "value": "fea5db3aff1f2fd2b8788e0606c0d6343c4619d53fe112437bae0ac2f6e648f6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324566, "uuid": "1c6f6c74-5a4d-4b4c-a796-515cb8323009", "comment": "Malware payload", "value": "2a2a6660628a4093dd94b33962d182969edc90b8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785324566, "uuid": "25761135-d5ba-43d8-870a-b43072f30d22", "comment": "Malware payload", "value": "ad7e9197af19f72ac51bfabe951bf527952f49642bf0a249144abd2b8c351b0162be461e34aac0a215e574bd11162b8f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324566, "uuid": "36d48928-c267-4d2a-85b9-76ddbf623830", "value": "T1F321D6E5ED25E690DC5B31BAF1F3C1AB284CB074065993145BB67EE991863EA2782310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324566, "uuid": "f7b4e102-bcbd-4d6d-b517-68c423ddf0fa", "value": "24:9bW4cem2rXLNUMTdjjgfYV63ywVcPpS65W2Hpe59nW7mk1dMhrwUElTP88WEn:9bprBRjjMY23VST5WkM5k7TwDoyE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785324566, "uuid": "0512ca3b-26b2-462a-930d-0993cbb48a79", "value": 1405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785324566, "uuid": "34d8ce6c-9a59-492b-95dc-c8403acbfe6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785324566, "uuid": "22d9b5b8-ce48-442a-90b5-0cd22b91aace", "value": "photov_295102126159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106904cd-8b39-11f1-bd95-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1785321262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321262, "uuid": "32f51382-9e3c-4a1d-a0fb-fa9585668b8b", "comment": "Malware payload (Stealc)", "value": "91b902474fed81407fd811fb273df070", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321262, "uuid": "50b017fa-5566-431b-99fb-63faee25ad90", "comment": "Malware payload (Stealc)", "value": "ff1c3a2866f389f8ec2e4d57600446da4d131bad8ded341aa6619c0a0d35f752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321262, "uuid": "43c83764-cd23-4075-be0d-2580026da2d1", "comment": "Malware payload (Stealc)", "value": "db1fd0534b1ce0369a871c3f2b912c7cd433ab31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1785321262, "uuid": "08bb3cae-35b0-4b11-a7a9-bd164aa19806", "comment": "Malware payload (Stealc)", "value": "8a8782b70c9230a36791d11ab605ed3420f121d4c0daa1724b029c0a2cec89f39d8103f38f0f22510a32e752a7cf478f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "StealC-v3", "colour": "#8FC001", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321262, "uuid": "f72db8b6-987e-4b81-a699-56a6308f09db", "value": "T1F7058E0AF3A502E8D0BBC1B4CA124456FB7378555330A69F079946AA1F37BA07F3AF51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321262, "uuid": "071968d3-b100-4e90-821c-e43eadf9f4e2", "value": "12288:2yu0W5kXYBKKn66H+9af6Gz613Gy8Fjyug8FrBNvsAHl3ou:2y3DIBKKnt0q6K61WRFjyIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1785321262, "uuid": "de7aa7a3-513e-484b-b9ca-fd3eef147cf0", "value": 822966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1785321262, "uuid": "52d85d42-8881-43f8-a16d-f7e0e73870db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1785321262, "uuid": "290a0c9f-1c6e-4076-b732-dd160a9ffa31", "value": "ff1c3a2866f389f8ec2e4d57600446da4d131bad8ded341aa6619c0a0d35f752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }