{ "Event": { "published": true, "date": "2026-07-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-05", "timestamp": 1783296182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1df78f9a-6c9c-429a-a840-698b189cb950", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26d0d7a-78aa-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783281103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281103, "uuid": "db05ace7-ac1e-430b-9eaa-85cd3b29d3d5", "comment": "Malware payload (Mirai)", "value": "7e192b0b65cdbde59564347f1e72fb95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281103, "uuid": "fda55ee1-8430-4866-9c28-6c8476da32ba", "comment": "Malware payload (Mirai)", "value": "006bb7dbad34a262eb724d3c7062dd3513c98df19b681146931dc0e952035812", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281103, "uuid": "ef224e97-aa99-4a30-a808-e43891c7a65c", "comment": "Malware payload (Mirai)", "value": "10522658e231ba6041769c69fd5f44fc866c3252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281103, "uuid": "5e107f85-95ee-4b1a-8fed-2e975d85cd62", "comment": "Malware payload (Mirai)", "value": "836a4cf1309cc526b44945de5d07a36e8dbff1c211bbda73ca3c39a6be75f031e0c776e041d6b3113d694a60d2c85759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281103, "uuid": "da65b90d-1ff4-43ed-9336-25dc2daf654d", "value": "T171C3CFD7F78B24A1C86147F047C73B8E2AA361019E6BD9E76C1E663B097A0DB49073C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281103, "uuid": "4f670a3b-d093-4807-92d8-5fe699bed67a", "value": "3072:jgK0DmFZtbBzklZz0VBd7lV8dCYggozNq:jgKTFZhG/sdkozNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783281103, "uuid": "96d3529b-99b9-4dc4-b1f7-1fbbadb4f139", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783281103, "uuid": "332496a6-fb24-4c70-93bd-3626f6cef8ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281103, "uuid": "ca98bf1c-ae7b-4172-abcf-d6d1b6246b91", "value": "ohshit.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abe37c4-7807-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783210894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210894, "uuid": "9c4c3730-a5eb-4d64-b2f7-a2dc5cb0ae08", "comment": "Malware payload", "value": "0413cbb5394de60195f92eb34775d9e4", "object_relation": "md5", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210894, "uuid": "bc6e19f6-7a45-4074-93ed-2060639e707e", "comment": "Malware payload", "value": "028c7bb4023c66785328a078fb9ba3787418c45aace2b31395b9e06443224f71", "object_relation": "sha256", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210894, "uuid": "b1581923-7bfa-4920-84c2-96987c69a496", "comment": "Malware payload", "value": "0ddd32dc4b3b4a6c339d14546759d4c1f94d4f98", "object_relation": "sha1", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210894, "uuid": "4b4b6945-2b7a-4660-9fb2-a0bf8d98c220", "comment": "Malware payload", "value": "5ea6cc01a0131589be4d30bbb4762e4916338e3869c42d8055f9661d3569012b269ccbf4551d07c3078ed9fc7518b9d3", "object_relation": "sha3-384", "Tag": [ { "name": "31-44-7-3", "colour": "#CE88C7", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210894, "uuid": "f779dd21-7ad6-4b52-8c4c-4710a4449b11", "value": "T14FC7335B39C7C4FBD4C509B0971777E713B7A2534ACA8C7A5AC42449D9E2FB2203E982", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210894, "uuid": "3ad9705f-6455-4bc8-8117-022d0b227f36", "value": "055f03c0930ee8e112600d2d9eea4c04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210894, "uuid": "51b5a8dd-6d00-42df-88d5-cb1bcf1fc9c8", "value": "1572864:+0N92y60WTub4IHvSytoHPeeEaytZVix8ULgZy9cZqN6rQe97PgS:+OLWTu0IKyc7EaytZpty9cZqkXPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783210894, "uuid": "23403ac0-de20-48cc-9096-d4a17688c1d0", "value": 57911808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783210894, "uuid": "884d9285-d304-49ac-8a59-17bda1547324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210894, "uuid": "603e3902-14a5-46af-b8db-2ab88e2faf26", "value": "chrome_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5609975f-783c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783233596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783233596, "uuid": "c04390d9-e5ff-4e93-a798-f5e30c47481f", "comment": "Malware payload", "value": "d3a43b2bf9889e31ed0205cfb5597fba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783233596, "uuid": "c1404a91-fca0-42be-9283-c330fc1364e6", "comment": "Malware payload", "value": "031ab13addb02aeb8ff051c6410c68eee333ee9ae17557a4dac753ac400b7054", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783233596, "uuid": "32cdff50-eb6c-49d5-8410-803a39dfbe85", "comment": "Malware payload", "value": "fc8c203502d7b2f2d288b9bdfb0d1136085cea37", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783233596, "uuid": "1f885d67-ecb0-4b8b-b39a-d7c0e6917577", "comment": "Malware payload", "value": "f089807f573a97aee451eadeebdb1c5a67812a8df31cfe1df67b29d5b39c6d5a76a2691e37e3c3b01d1fce3e4ac5b88d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783233596, "uuid": "8301bacd-a801-4ac2-a95d-7c25e9984626", "value": "T155D097E275A3207004A3AC25E0C36800B6880F7E6E00C3AD720758306FD034EF0C07B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783233596, "uuid": "96cf2b79-a9ae-4c19-b6ce-930d7904c3ea", "value": "6:hTDTGqbOHAqrDj6bAulNXYq4HvXDG+NjVsNXYrkJ:VDThOgqmbPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783233596, "uuid": "e73b318f-84ca-4bb8-99a7-69996ecc7788", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783233596, "uuid": "14e709a0-ab7a-4a39-a0e6-d1d4e686d34b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783233596, "uuid": "15b0a6d1-0f59-4b0a-9d4a-f1d3fa4af80a", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa1d074-7875-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783258031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258031, "uuid": "bfb23d55-056c-4c4b-bb4d-b6d39d6ba90e", "comment": "Malware payload (RemusStealer)", "value": "8ff8509c63c8dcfb5349a7691c0d7363", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258031, "uuid": "4c0e7341-d661-40f2-bc1c-59fbfbd264b7", "comment": "Malware payload (RemusStealer)", "value": "0350de7cdac919529ec58d085ae1eb7ece2bafba425593fbcedb7826a84ee713", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258031, "uuid": "af100c31-2c2d-4efd-a75c-3e1c6e5e71e5", "comment": "Malware payload (RemusStealer)", "value": "dae33edb4229db54bab5a44da6a2e71c02f9fd48", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258031, "uuid": "7717432f-b0bb-40a0-92c9-18f4946131f5", "comment": "Malware payload (RemusStealer)", "value": "1ea74ec205ba74dc0a4663258afdc19e9787170a49657d702ad3df2f644459c85d8dac9b49ad650fed871d52a56d4d96", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258031, "uuid": "201ce746-6eec-4ed2-b53b-5590b771dbbe", "value": "T14FA56B0B6CD049E9C8AA973288B652917B35BC454F3237D72E90B7783EB27D19D36780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258031, "uuid": "23075c31-ce03-446a-b93d-f36ae3233c5d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258031, "uuid": "684f9fa8-32b9-46a9-a66c-dae9d4829625", "value": "24576:jtOwZW+KYk0lS7+XY5zGPYDKWlYq4e00GLA92mmJtxwBele5rK22DN3Znk37V:jtxYTY7e+IxEcznWLXs8b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783258031, "uuid": "4954ee6b-6393-44c0-84ee-2fc87278df65", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783258031, "uuid": "9650dd4e-17b5-4b38-beb8-619b9f367def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258031, "uuid": "336f8b6c-0961-458e-aaa2-5750380c3c35", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2672e329-786b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783253702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253702, "uuid": "b2f57c09-2136-4315-8764-93e852a7f0b7", "comment": "Malware payload (Prometei)", "value": "b6036757f923870de90f4f55c982ae24", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253702, "uuid": "9c76582d-bf16-4034-b3de-1eceb79e4351", "comment": "Malware payload (Prometei)", "value": "03d5fc868fcf397df7287b093a8c0d7ccd9f8e21f1bea1b8fb4298fd874195f4", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253702, "uuid": "cdeb79e4-323f-43d8-97e5-fde6777eaf45", "comment": "Malware payload (Prometei)", "value": "36913c18550dc4ddf4dd7a94195515982f9443c8", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253702, "uuid": "c21e9cc9-b8f1-41b9-b847-9d682fb7dd95", "comment": "Malware payload (Prometei)", "value": "1ed250d93a0969a5f438de32b056346d56013574c037a0b4aa53056b132827293e8cb983dba5ddb0885436fbf6ff8281", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253702, "uuid": "fcc1be7e-03b7-4261-a32b-d6e2e6ccea2e", "value": "T16DF0208AA44470E3E347ECBCAA0CF219528342D0C220EA3870CC5A738F7B6047CE7B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253702, "uuid": "0ab9a4ca-a977-44ae-bd26-63f06eeedc16", "value": "12:ngCNAES+FNZkT/kqcEDLuzRmonB27gbu3P:KEhl3EDCpB0gu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783253702, "uuid": "ca4fc936-4218-4553-bef0-39843c8f43b8", "value": 480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783253702, "uuid": "11081dee-70af-44e6-972b-5386cdfebd7d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253702, "uuid": "e4d1124d-b8db-46c9-883b-455a0c96a4e8", "value": "03d5fc868fcf397df7287b093a8c0d7ccd9f8e21f1bea1b8fb4298fd874195f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c453b9-78a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783278053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278053, "uuid": "86af7688-4cd2-4c04-a1e6-53f03c5780c6", "comment": "Malware payload", "value": "1a50e99091d61f0d9510c6b8e6eba7f3", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Puwaders", "colour": "#AA0059", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278053, "uuid": "48df07a9-1501-41bc-a9c2-423aec63b7dc", "comment": "Malware payload", "value": "06e8c8c4d5176e7dfc37d2354a08caf5f29b695118b3bd6d1fdfd6d84dbcfdff", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Puwaders", "colour": "#AA0059", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278053, "uuid": "cf3c828c-f9e6-48ad-a980-1de5991f20d2", "comment": "Malware payload", "value": "931d0b94aa49ac3ac40462bb205c9a903ae4250d", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Puwaders", "colour": "#AA0059", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278053, "uuid": "21e73763-d5f5-4472-bb88-cd71de33f1fc", "comment": "Malware payload", "value": "c59c1bf0a26a96b999e90462c697ac4e8b9687ece6213f6b251ea3dc8298ef21261202ce1f2f805a8055391091fba338", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Puwaders", "colour": "#AA0059", "exportable": true, "hide_tag": false }, { "name": "tedy", "colour": "#504ACF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278053, "uuid": "6415effa-a11c-4b56-a122-1c6051f572c3", "value": "T14244836AEF849CABC4F798F77C102A3FE0C4656347F46EE644C2597D1A4884E17B9E80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278053, "uuid": "934de581-c1fa-4777-9d17-cb9f57ddbb7c", "value": "a4b6231fae7f0ff5cd8420656357e7cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278053, "uuid": "aac9e788-f7e3-434f-baa9-ab7448eac377", "value": "6144:7jk6/NZmTBlNKjbwxVEP1dCJFBExdecbCTEj/4IINVWh3ReFqjjxp5twhvpdJ:zz5Rm6wJpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278053, "uuid": "e8e84ddc-b210-4a57-be72-3f6f3a8b4035", "value": 274432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278053, "uuid": "4131cb81-2140-4a70-a22d-97b2e624db6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278053, "uuid": "3a957b9b-406c-4153-83aa-4ec321d82836", "value": "TX_1781953860482.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adeadeeb-7890-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783269821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269821, "uuid": "ef0d3664-aeda-4eda-ac06-f00f693ae72b", "comment": "Malware payload", "value": "83e0f4cf2c0a14925e04603652d12ae8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269821, "uuid": "1cc06081-34d5-4f61-948e-24d7f34e2dc8", "comment": "Malware payload", "value": "06f341cf422dfbe0cfe3a571b1b2d0e5997c6074e4edbd1f4e3b3db9003c338b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269821, "uuid": "4ba9aad6-81db-42e0-91df-43f42c0cf57b", "comment": "Malware payload", "value": "945468904dd6c4b46f630b9d0c0b96ef5bc90a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269821, "uuid": "839627d5-e56f-4a77-a6a9-e897e212e8a2", "comment": "Malware payload", "value": "c4c5dea098289d077c5576e32de889cab050c47c94b30da2fe4a17e77b500fc47a49b441695719b9bdf02660b6b40973", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269821, "uuid": "bb07f11b-5e4c-49bc-9444-8248da72bf0e", "value": "T1E16423BDA42A96695B18DA73032C163FF8916D7D588F982924FD8457CFBF8004352FB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269821, "uuid": "19dd3562-8010-49a6-b0f3-0d8a0a110c3d", "value": "6144:f7FibhI9VeUEut6rUWe6hQJoCQzouf9xAzLHYOL4ZZ2ebKNmxUTOhvPwMY:xilI9Vtv6rURrHQl3AzLHYm+WkeTivod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783269821, "uuid": "904d847f-98fe-4f21-bb00-85c0e0175328", "value": 310488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783269821, "uuid": "3cef2987-7c49-4be8-ba4e-c310071c1ab3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269821, "uuid": "ffcf257f-55b9-45d1-b1ea-ad882bcd5da4", "value": "kaizen.mpsl_r1_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1960f350-78a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783278162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278162, "uuid": "e1e1c412-84bd-477f-a9d6-155a796d6bdb", "comment": "Malware payload (Mirai)", "value": "e7f9a6226756f2cba52811b2abfc3127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278162, "uuid": "bc72dc56-d714-4b92-8646-eb1bbdf22d04", "comment": "Malware payload (Mirai)", "value": "06ffe84018080c60e67093332982be429619328bee027e104bc38a276e852c0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278162, "uuid": "7074cd62-36f3-4e5f-846e-e31425d39be6", "comment": "Malware payload (Mirai)", "value": "75daadd1a557c374a18de17f057424d32c88e8eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278162, "uuid": "53de33e6-7eab-4d8f-b5da-31d3d7739dfd", "comment": "Malware payload (Mirai)", "value": "efcc35cc0f3fdc6c3c230f5503d93076991e4dc8a56cb6cc5800db123fb7b36ea5009e73ed2c62ff7e1c12bbc731d454", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278162, "uuid": "f635ac8e-fdf5-41c8-ab12-f1265ceb692c", "value": "T17DC3E709AFA10EFBE8AFCC3706E8274524CD5A1625B97F75B530D828F24A28F15D3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278162, "uuid": "6ee7d530-9966-4421-ad47-06c8b7881cfa", "value": "1536:XgafS3fr3t5sdwB+a1PR7vHL04P0lcl7H8IgW5tEZQpt8RV7ubOLHFjcaFo:xkTsdwB+a1P9cs5tEdkCjcaFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278162, "uuid": "5e211610-29de-487f-a6c8-a215c7e6b13c", "value": 122164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278162, "uuid": "b6beaf7a-10bb-4d15-97cb-3a29b02ef773", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278162, "uuid": "7359a74f-de52-4c79-b668-0ec0573a06cc", "value": "ohshit.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822f9b6e-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209618, "uuid": "3faa3772-32b5-4905-aa41-66a96736f4d8", "comment": "Malware payload (Vidar)", "value": "b703aacd3e943ffe9083c14779cd7cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209618, "uuid": "529a57c1-bf1d-4fad-a775-ce723aefcf5c", "comment": "Malware payload (Vidar)", "value": "08510ddd7019a2fb09d4893c35ddbb3356cd8ce3fe6e43fa68f9f13e95287d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209618, "uuid": "bba79820-973e-4d5b-9aad-75e33eeeb23c", "comment": "Malware payload (Vidar)", "value": "aa5e4452366f883dbb8a551b97a25e2739ca58a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209618, "uuid": "b757d253-4ce4-4cdf-acd9-b9816fc17dad", "comment": "Malware payload (Vidar)", "value": "33396073f86db3f766c9a4456fa410a22dd54fa5ba6a5773a7f171eff343d918513420dbb8530de0140416eed04583ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209618, "uuid": "c44ef93a-ab1f-407b-972b-8a633d723d4e", "value": "T1F3E59D0B7CD145EAD8AA92768CBA91927B71BC090F3623D32E90B77C2E727D44D36750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209618, "uuid": "ac2e650a-d860-4486-b71b-ced467823f4e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209618, "uuid": "f91f5b45-9545-421b-9401-c8d7e67bd27a", "value": "49152:D2HjesePiRBf3QcZrfbp//6mhcZ6sqeoHe3go:D2q+n5/6acZ6qTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209618, "uuid": "9ff0a815-c438-4171-80ce-5f3077e42309", "value": 3021688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209618, "uuid": "eab44917-035c-4f76-a9e7-d24010b0be5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209618, "uuid": "c1a89757-6575-4755-83f5-388a535e526d", "value": "SecuriteInfo.com.Win64.Evo-gen.25595179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbbe74b-7881-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263350, "uuid": "6ac3a3b3-4d54-41b0-bb84-95c33112ed46", "comment": "Malware payload", "value": "95dc24dbb4befe8181a86582b42c6558", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263350, "uuid": "9c49002d-61f6-49bf-a756-ca60568bdf31", "comment": "Malware payload", "value": "093c727149837d576d10f843edce933436efe648e74b9008ccd91badf197fc5c", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263350, "uuid": "8afe5917-9489-4338-abc4-9bfd8f9f520a", "comment": "Malware payload", "value": "c5b2688416856333c97403208e2b7852e2da72f7", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263350, "uuid": "b6fa4d62-857f-45e0-9912-c568d8a51bf2", "comment": "Malware payload", "value": "29de3e91401dd544a58703f9d3450afc863e67a8314cecfc481e5eb18d60428eee9732ecbe64d18e608859fa61e0ed8e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263350, "uuid": "cd7d19ed-689c-40c2-b9b3-55f18caafc8a", "value": "T19266125AFB0CE23FCDB724366AAA13262317505651A2D7635514C22CAEC3ACC5F2BFD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263350, "uuid": "17a27f40-16bc-477c-99a3-09109bfb15ee", "value": "98304:tld3zJh4ukKaRNdA4JZEgZHzQFq4/88KER3kwIigEcYHuSuINVA3r9RS:xjw5L+1eTsq4xPR7IiDcSuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263350, "uuid": "578cbf02-dc0c-477a-93e7-4df67a32f400", "value": 6695449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263350, "uuid": "6c57c95c-12e3-41b6-a0c8-fc5f45956ea1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263350, "uuid": "dbdc1b56-9d13-41f6-a871-ba60bab477db", "value": "com.slipped.magic.hdcamera_3.02.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9c714-7893-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783271024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783271024, "uuid": "22919205-9827-48fc-bf5d-f77002f23ead", "comment": "Malware payload", "value": "3c2d81fc3d9f160caab8683b5a8e56f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783271024, "uuid": "63f705ca-265a-49c9-9c09-0ae87bec14e0", "comment": "Malware payload", "value": "0a48519d35d37581c4130129a056268acb2cd348072a92993e6acc745bd5f308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783271024, "uuid": "7d964da0-267e-4a5c-afd2-7c69c1b0bdd6", "comment": "Malware payload", "value": "0a711d2ea469974b0d54f46aa3b85ffab53fc872", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783271024, "uuid": "550905a8-bdb3-439a-83af-6ccfd6b67e4f", "comment": "Malware payload", "value": "1c9b3943e0594bae75fd5ec6160bf721060cf94971493d74bcf9bf107f1daf45cde894497dcc6fcf7b3d412a0bf6aa03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783271024, "uuid": "272845ab-1fdc-489a-8521-a914bddac02c", "value": "T1006423F9A1660C43CB474B7B7682F9CE9791039AF4CD2536C7D881FB04FDA0409A2B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783271024, "uuid": "cef71760-78ea-4204-ba6d-7c6ba50b63e1", "value": "6144:JZZ03Q1u6KDZkBgDM/Uf4YddEcnbqCJ0ydqoekuitKX9BLi0BCCl7xGE499oir:LAQtKtQ82cn50yd1ZYx0E499Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783271024, "uuid": "000f8654-6760-4b76-85a5-879bfca06d02", "value": 310416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783271024, "uuid": "e620d067-a514-4507-8196-546c7090234f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783271024, "uuid": "6cdcd05b-6a5d-41f4-852c-8cf280dc1e14", "value": "kaizen.mips_r1_srv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c084091-783e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783234331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234331, "uuid": "a5af8a88-03f1-4541-95a3-917a173f28db", "comment": "Malware payload (Efimer)", "value": "1d870228df077b8fe89d4ab2043743d4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234331, "uuid": "2084f60e-a407-4ed1-a4d5-c7e5d4b97016", "comment": "Malware payload (Efimer)", "value": "0c422e9fc527cc1d97a81606a42a6bea2c83295552ec3ebd49adcb41e50650c8", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234331, "uuid": "7bf6d1f9-eb54-46c6-b3a4-aa4cd97ff9c6", "comment": "Malware payload (Efimer)", "value": "114777ca06522cfb98a8c9e93fed5330e78dff56", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234331, "uuid": "f47304b3-7481-4ca5-87fd-ce098d524ccf", "comment": "Malware payload (Efimer)", "value": "bf9ef03174bde337aaad5aca900f93fe5a2c3a134774f33ef8a1d54aaf026cd79e7f146a15631727ac5cfba7dacf92cc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234331, "uuid": "bb474451-cab2-4993-a3b6-d460fbbb3a6e", "value": "T197E6332DA6E026FAE572803CEDF19598E524B47B1371C5DB0BA4D3B21D2B6D04D3DA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234331, "uuid": "a1b787ea-e685-4f76-be37-b354452fee7d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234331, "uuid": "ddf5528e-1586-4bac-8fd7-1ef14fa0cf1a", "value": "393216:jmchpkX3vyJO5CexH6KXhYiLFmoXMCHWUjX/cuI3/PGTAI:jTkX3vyJACexaKxVPXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783234331, "uuid": "688a1d0c-cd00-435c-b621-428489728369", "value": 14305235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783234331, "uuid": "c9fd8d22-b6b8-4d51-8e46-6eecbe868901", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234331, "uuid": "dd78aa1d-e32f-4d91-8c34-eb2c86c3f772", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3631e58c-7841-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783235690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235690, "uuid": "2ac41c1c-7e28-44d7-ad68-8642e19027c3", "comment": "Malware payload", "value": "0f0649b820f62187f7e3e8f3039b0954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235690, "uuid": "a674b607-f82b-4610-ba14-5a3fc2317846", "comment": "Malware payload", "value": "0c45413122e68f4397fba9539fb74a67343a6496672c1a55862f95e2bcb105c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235690, "uuid": "9e7856f3-74d2-4628-8457-62141a09ca12", "comment": "Malware payload", "value": "7760cd8c3298e35908d90a5f4762c4f55e847b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235690, "uuid": "64c15606-394f-4e59-a07c-f7de9d1a432a", "comment": "Malware payload", "value": "d1566c66a2c65ae0d3b80ecee888b3dd868a6b12fb9f5f373bf5166f63f2c456cc6139cf96b4a26ff469fa751bf8fdae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235690, "uuid": "32cf5112-86d8-4d43-8805-35c80987be00", "value": "T1E5736D509245C2E8FA5B58F9D964162BD3F0F0643BA49BCF8B7089193F576F26D3A380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235690, "uuid": "8114b894-ef03-45c6-bcd2-81536473496c", "value": "93aaf72477167a05c85c15e6440d1c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235690, "uuid": "8ed772c3-8c07-416a-b952-2a17c966c54f", "value": "768:XpVrdKcAg8IqX8/6ebMmRbjDpDxHDrf/J3FuD/CWZWGBJxlF+kNjPLN0Dd95:XDBJAHg3D/RVub5IGB7++aDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783235690, "uuid": "f392f6e5-f5d2-436b-89d6-9419ed694379", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783235690, "uuid": "fa570477-6681-473e-b0d2-3b4daad15c2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235690, "uuid": "b585a0e0-8299-4076-a957-57088bb57ea7", "value": "0c45413122e68f4397fba9539fb74a67343a6496672c1a55862f95e2bcb105c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77af308e-782e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783227639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227639, "uuid": "a96a460e-2608-4c7d-884f-72bd5fbd2ac5", "comment": "Malware payload", "value": "2a49cebd7ee0f260e6e0ae65e7ea0ca1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227639, "uuid": "976b88d3-ebec-4b69-9bd8-d57e245d6a01", "comment": "Malware payload", "value": "0e84369ffb478e4bb385070c2e62d692619885bb42008fbcff7e2f6a16e86f6c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227639, "uuid": "faa0a190-ec85-4c3e-b5a7-b254bedfe0a5", "comment": "Malware payload", "value": "947bb04e364afcac611635e0da0c888dba159e5e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227639, "uuid": "300b9719-0932-4932-a1b0-d9ec360218c1", "comment": "Malware payload", "value": "0429d91d9edb490be3097080c2b6b3708c300625a4c1ffae14d7d8bc483027835247e717a78498ed7707bdc4a92efd0d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227639, "uuid": "67c562f9-5e35-4635-9acd-d3ad71a1e02c", "value": "T145668D13FCA155E9C0EA963189629252BB71BC882B3023D32F50F7782F76BD46E79744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227639, "uuid": "b7e841a4-9c08-4e37-9099-f5f396a8b458", "value": "98304:/YlFp4lE4zOPTrLMGMCCGiBkcO4SGTicAW2S3:XW4u4G+pBknjGTOW2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783227639, "uuid": "b300e4de-0411-485a-a254-7a00a710da0f", "value": 6759582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783227639, "uuid": "bfc9a4e9-8ee4-416a-b34b-d94ec6cdf087", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227639, "uuid": "df9fbaaf-1d82-46d3-a183-98442922e6d6", "value": "sample-0e84369ffb478e4b.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ab00e2-7851-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783242851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242851, "uuid": "e52db549-28d0-45c1-bd38-b097d7ac692f", "comment": "Malware payload", "value": "411f63fddc41a23838206b2ecf932a20", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242851, "uuid": "aaffad00-22cb-4018-9b2f-3efbd9201fdf", "comment": "Malware payload", "value": "0eacb4b988838c45ccb50c57488056513232ef3bdb3e141ddacfa5c5c6e0876a", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242851, "uuid": "04deca7c-5a9e-4354-8520-028f9722a61f", "comment": "Malware payload", "value": "c27ea168bd75d1637ccdca670fc747d58353d2b2", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242851, "uuid": "8cbc4361-f237-4cfb-b28e-6bfb569eb59c", "comment": "Malware payload", "value": "f1615c781cf8d0ffa489530acf5ec078e74c1a27ee49ff286faf8ef654e07c500054de9c17d5a644e86a4e536be27d84", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242851, "uuid": "ff1f1596-d5f8-48b2-bf6b-ef74aeb426dc", "value": "T18D08332C1432D058FA19A4F711DAFE72E384C6737135489E49689BA026FB8CFE0DD667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242851, "uuid": "a5b8eedf-b1ad-4c01-bd1c-b74371538e60", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242851, "uuid": "22575b7b-8f54-47de-bd5f-a2078b1f4728", "value": "1572864:Gt9IKPWmrgRWYV2IpeL+QvGRJMpuoF3bI3IRVAIa5KP7:GUKOmERWKHpeLDGRaRBbI3ik5KP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242851, "uuid": "859d400e-4f11-445e-8e8d-c2335b55f2d6", "value": 77477267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242851, "uuid": "bcfa177d-ab1c-41fc-8fdd-a0915aef606a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242851, "uuid": "0054169c-522d-4939-bb41-9e737223293b", "value": "kms-net.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78b45e0-780a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783212311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212311, "uuid": "cd9b6e06-542b-44a3-8853-eec7acd395d5", "comment": "Malware payload (Mirai)", "value": "1e7e1b36f954d5c9e04525f2fbf8015b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212311, "uuid": "cd46cfe4-2599-45b7-8f6e-69ce5aff95ae", "comment": "Malware payload (Mirai)", "value": "0f2bd4b70f03a3f5eba2121af97e5afb3c5969e4887c960c00d4c5b02c5c785f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212311, "uuid": "eed45db1-1f33-4cbe-ac54-bf1a660c5bc6", "comment": "Malware payload (Mirai)", "value": "e076646dcc964ef6e4f78966bd8f387f6a0b77c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212311, "uuid": "e1a44149-3e6b-405d-a7e5-80fbd7beba19", "comment": "Malware payload (Mirai)", "value": "a3325a5fe8541e0c14e2f8105381b738ad72a20e3503e9c846a7bf6e3d7235fd7bd9c4c50f2f90f8127b3e56eb3f99b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212311, "uuid": "2bc97e91-b388-423a-9a0e-dd57ece4487c", "value": "T143832A91B981966EC2E063BFF95E928D333563E8C2DE3523DD118B1137CA61F0977A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212311, "uuid": "417b0c2c-15a1-4021-9a00-c66d36eb1b68", "value": "1536:GT3qwGZbgDoB7bx4gJy+b4pu4N793L3L72mWf4Iyd2FEd:4UZbn7bx4gJyfJ3r/ew9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783212311, "uuid": "7719dbae-3dff-417f-a9a7-c8cffa87a7ec", "value": 81780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783212311, "uuid": "1c784cef-1884-4f4a-b059-6a9b3ea674ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212311, "uuid": "4e5e0c2e-0bfa-464d-949b-f3b129200bcf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c18b2e-7870-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783255931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255931, "uuid": "eb2ba22f-57eb-4cf3-b26e-196ab495a69b", "comment": "Malware payload (Efimer)", "value": "35fbf0e5ac62961db04cd6d549a5b6e1", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255931, "uuid": "6ef9ff10-f266-4851-b487-66cfad9f9aa8", "comment": "Malware payload (Efimer)", "value": "103f6414452ab0352953778d6478096710a619645c5bf5d274552ed5c478ccdb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255931, "uuid": "f2d325bf-989e-4a8a-b8be-f6fee451f9a4", "comment": "Malware payload (Efimer)", "value": "8a9ebdbf4f6d5ec8e7a14b74205affe666a4655c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255931, "uuid": "cbc820a9-702f-488c-ad74-45ab0ae4cd91", "comment": "Malware payload (Efimer)", "value": "1cf133a4cbbbce8804890ec01edc865168c99f3861e70db89764cf6a08ddcac4d92393217c58f7f6dcf8f5076ecbf304", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255931, "uuid": "284c5230-4685-4184-bc25-ad9266934476", "value": "T1C6E6339863E20AEEE573813CEDE226D9C065749247B1C8DF0794CB617E531D08D3B9AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255931, "uuid": "b7d10628-23a4-4b48-a004-f852752554b0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255931, "uuid": "b8fc39fd-82dd-4421-b872-a2dd8cde1d44", "value": "393216:uDXW5Iy9GqS9XulZsmb99cgtFfLXMCHWUjXicuI3/PGTAI:uDG5IrUnB9VlLXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783255931, "uuid": "3b72ca67-d37d-4758-9ab4-881c019ecd0b", "value": 14279203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783255931, "uuid": "e44bc0ec-6c88-4303-a1a4-bc4b00f7fadc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255931, "uuid": "ec55563b-ebc1-45c7-a22f-c8fc450734f4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071f8c73-7856-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783244630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244630, "uuid": "12a71393-f9b4-40a0-88c1-866ea7bb61cb", "comment": "Malware payload (Stealc)", "value": "d3f9acfa6119f28d666e25d7e078570a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244630, "uuid": "7ec6de55-0edb-48a9-9e33-08b379ddfca6", "comment": "Malware payload (Stealc)", "value": "1095cf2951bbc8b1ecd33798afad192449a102aa1b976fb60bf566a08d693587", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244630, "uuid": "ca016e21-bee1-44b0-8c2b-d78f3942d37b", "comment": "Malware payload (Stealc)", "value": "53e0bf97e465842a9130aae1fcdf0968273f6d14", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244630, "uuid": "a5e7c536-4c1e-4b8c-8ea7-cb63dcd36cec", "comment": "Malware payload (Stealc)", "value": "a48159bbc29b8b8c28e6093811ce7c5f683bde7ec69e71d090cfd752fa7edd6c8af62db9933ef6d1507370879abbfa54", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244630, "uuid": "9c8e7157-8296-4372-a629-bcbe00388003", "value": "T112D57B0B7CA009E9C46AA73289B791963B74BC494F3223D72E90B7783E727E15D36744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244630, "uuid": "0dff7871-e22b-46e0-a35b-61bde2cae0fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244630, "uuid": "32358430-13cc-4658-a775-c8b36545178f", "value": "49152:lZcQxcwJ96JDZNWS1OHtwA08eMxm4zgvo45Dii:lZdort1qdReMdMvr9ii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783244630, "uuid": "9fde4ab2-fa64-400f-96c0-dd2656c151d0", "value": 2794896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783244630, "uuid": "dc23927b-2e8a-42c5-854a-71c748e0d675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244630, "uuid": "2d724422-34da-414b-a249-57e8620c3f14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f176c311-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783220113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220113, "uuid": "b0efa2e7-cad0-461a-9d07-5a6a531c6f0d", "comment": "Malware payload (ACRStealer)", "value": "8a4c99ebd4cc814064ef6b209e8aa874", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220113, "uuid": "6a826eb1-d831-4c10-a01f-ba6e6c6c129a", "comment": "Malware payload (ACRStealer)", "value": "11936fb09c6770b658ce5335e704bdba76722e1282eb53630beca2e007bb0850", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220113, "uuid": "8fedfc8e-4766-4486-9533-0d32e3b6ba7e", "comment": "Malware payload (ACRStealer)", "value": "51c6fa57c0590d67f12565dbf43a8b35e9935ebf", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220113, "uuid": "597ca711-0902-4997-83ed-41fd02b6f44b", "comment": "Malware payload (ACRStealer)", "value": "91819d9e62fc9beafe435ded412f03e399c826e0b2a5ca2dd328eef9e0a27e0924b52cec5f04867a98f075791242efaf", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220113, "uuid": "ed25a0d4-da16-4289-bcca-1029bbeab886", "value": "T10EF63386A4B21FD6D89C013D81AF8B47639ABB074043936B5764E36B3FF37F19929940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220113, "uuid": "09b9b460-361f-44a1-9180-0673a81c7934", "value": "393216:2UPTC40OSoynIC24FYlry7NTnhA+Trw6NXC8eFBT:+40O1yt24HhTh5TrnXC8ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783220113, "uuid": "bd0dacd1-2442-47bf-af16-147c519b6d7a", "value": 15585832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783220113, "uuid": "ab80dfb6-567c-4c8d-adb3-8661defe2309", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220113, "uuid": "85c0e7b7-8b2c-45ce-b471-3578a15ba4e1", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99032bcc-7845-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783237574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237574, "uuid": "7090c6c2-d7e0-4968-9fcb-57b069213c07", "comment": "Malware payload (Prometei)", "value": "07222bbf7182faf773a04254186b7ba5", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237574, "uuid": "ab02bf03-e1a9-4f83-bf44-7d2027c53943", "comment": "Malware payload (Prometei)", "value": "11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237574, "uuid": "03432fba-0278-4543-9ffe-cf853073c4e6", "comment": "Malware payload (Prometei)", "value": "e88399ad4629eb666b651159a9484c3625755c5c", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237574, "uuid": "ddfeda60-7273-439b-a717-73462c27e49b", "comment": "Malware payload (Prometei)", "value": "5c036bc4734126c04ee046f0bd9c73f269fe01c596cb7f50cf2c9b41ca79640d6f91d4863acdb2d214d2c76d28d60660", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237574, "uuid": "fb9426f5-ab64-4fd5-8838-7f126f76e3fa", "value": "T183F0F9E1B9379C7E768A8924F21EF4CEE8C694EF9025F86CA24A4C204B4821C500C715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237574, "uuid": "e9a16384-c8f1-4be9-92e9-620fe25bdb5b", "value": "12:oTEb6ZZFilDwp/NErQ/IFFHc/WrQ/ZK/NErQ/GV:oy6BQDEEGIF1ckGZKEG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783237574, "uuid": "de92b925-99ee-4f60-9998-e9cb6a40022b", "value": 630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783237574, "uuid": "8666c216-22b5-4a3a-9356-b9c2c042867a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237574, "uuid": "7ffaaf65-15e6-4a25-a31a-f9a10d074ce4", "value": "11af36dc7172a2e183ca5bc4dab9adb8e581b6ab3544bedafe98917e9a05acf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da36534-780b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783212563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212563, "uuid": "d182947b-4bef-4aa0-bace-f8d2f6dac99f", "comment": "Malware payload (Mirai)", "value": "8f2d3180b697c8b138e2f3a1cd0936c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212563, "uuid": "3ff15b30-bf87-4f7a-9ffe-88e9c174aae9", "comment": "Malware payload (Mirai)", "value": "12db9c40d7315b02d5231d11e04854b0c1ea3574219a97a32e6cd6a6cf8e8f60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212563, "uuid": "3675f2c7-b141-4d86-a6f2-9847c647a12f", "comment": "Malware payload (Mirai)", "value": "c409dccd86fcc0cee4294c188070ceb2e80dce40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212563, "uuid": "29007801-f560-41c9-a52d-4b8043a25c06", "comment": "Malware payload (Mirai)", "value": "ea88a899ff07cf757cf0f5b10656e73170f0a03bd95d53b9854eb19d75efe1ce630cbde00dd7fcf29eba3d129ad6b28d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212563, "uuid": "d42e7005-a7aa-4373-a568-e712d507b8f4", "value": "T1FE442946FB414A13C4D617B9EA9F42453333E768D3EB7306D928AFB03B8779A0E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212563, "uuid": "5b0421ed-2543-4395-b63c-e82a436bafb5", "value": "6144:lRv2k9DAMk5WIs/H1ByajPl0qv0MtuclBii8hE1V/Gpr2mC2qC5s:ll/9DAMCWlH1ByajPl0qv0SxPuE/I6mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783212563, "uuid": "a40d36d8-50ca-4cee-a439-f43e9d0617ab", "value": 257946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783212563, "uuid": "c6c0a16b-f9f1-4e8f-94a0-ffcbb51907ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212563, "uuid": "8bfba9da-655d-4af2-a86f-089d1eeeaff6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5923e5d8-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783219857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219857, "uuid": "4f4ab9a2-02b1-41a1-a93f-4977aa7184c6", "comment": "Malware payload (RemusStealer)", "value": "fafe52bd2c298f8b7a88ecc8778fd098", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3179", "colour": "#814926", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219857, "uuid": "91ea544e-1461-4a89-8dd7-9345454c8760", "comment": "Malware payload (RemusStealer)", "value": "134385f37bc37813bd7b811a628b700d0791c31c2ea0f2cf037d2463e02976f3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3179", "colour": "#814926", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219857, "uuid": "8faaeb21-2736-41ac-9e7d-2dcb3bcecadb", "comment": "Malware payload (RemusStealer)", "value": "659251f9149677fb5515b3ce45078fba2dd7f2c2", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3179", "colour": "#814926", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219857, "uuid": "0227c082-d21b-4d7e-9ce3-91e940476c84", "comment": "Malware payload (RemusStealer)", "value": "a46a39c239f128fcc9f2954442c4bd1cd07e45ec4b3654f6cf16ac807064ff1d503abb515a58eaf3faabdb06820a4b1b", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3179", "colour": "#814926", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219857, "uuid": "74397ac2-02ea-4c41-a94c-5539959b281e", "value": "T12107337180058ACA3A332CB87B35621A1D75C6197A2CE0DD3E6F91AC0BDE65D4B4DBD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219857, "uuid": "f112eb73-9e31-4881-9189-c2434898e926", "value": "393216:73nIZmav9nMUy7xTt/hqsGeQOuR47lOpPRA/65VFPoTq/NrSC:73YmalnI7x+sxQ9yYRZGG/lSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783219857, "uuid": "41256e59-83d1-43b4-a943-e6bfd59755f4", "value": 17803475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783219857, "uuid": "7fa2ff7f-f8d9-47fd-a28e-8c026497b772", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219857, "uuid": "a354f133-3534-471a-9690-d47158ecb865", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49ee228-78a6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783279362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279362, "uuid": "9b969150-d6fe-406a-b55e-20e7e843ae40", "comment": "Malware payload (Mirai)", "value": "74d0678badfa32361f24612ddb556b11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279362, "uuid": "e26b17b7-462f-4d24-961d-d813eb39612b", "comment": "Malware payload (Mirai)", "value": "15761f2f036c388f2afcee8cdf507f59c9de0308f696c40cc68bb043027c0bd6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279362, "uuid": "d2ba2975-3ac6-4afa-a727-7356111a8dd5", "comment": "Malware payload (Mirai)", "value": "8145f1dc3dff29dae52ce726014d16a611b1c9e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279362, "uuid": "4545e488-e24e-44dc-8edb-84853359da55", "comment": "Malware payload (Mirai)", "value": "2808d1492c5fc719748a12eedca2810990b2655b45aa1bef3bbc5d9eef853f31bf2bf185f866fab3b8858a64d0a9f875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279362, "uuid": "6f7c5333-207c-4502-b47a-74f6479186e6", "value": "T13A83AE63C9262C98D55845B4B1B4BE3B1363E95056532FFB15AACE7A9043EDCF8093F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279362, "uuid": "dd8b05ad-0be4-4c51-8024-711c5551f8d5", "value": "1536:e/9ciIu9Jk4/ArouwKS6FS7k0cbDClL5Ywhcn8J:eVciZY6luXSZpcbD0R+n8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783279362, "uuid": "4f344e76-af1f-408c-98e7-0abb9a0e2f81", "value": 83488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783279362, "uuid": "4e91ef4d-ea4d-4b01-891a-feffb6b7ae3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279362, "uuid": "6a67c88b-c250-4ffa-905e-5aa65bed04a7", "value": "ohshit.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844d428a-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209622, "uuid": "92513c24-38c6-4e7b-a350-55671ba72574", "comment": "Malware payload (Vidar)", "value": "9fdb32623242973019d8eb9dfc1c96af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209622, "uuid": "49f76f36-9443-410d-8907-638e048ef8c2", "comment": "Malware payload (Vidar)", "value": "16d67fa1f9e77c465e62a6a37f0c5bd54b8385215a5f40b1e5644dd3d84e0dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209622, "uuid": "32048bad-cebe-4185-859a-be39891e7bd4", "comment": "Malware payload (Vidar)", "value": "499850d03ccc25102d17584956bb01e53fd5aa6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209622, "uuid": "99c601e2-9fb4-4019-98eb-a17b9db89550", "comment": "Malware payload (Vidar)", "value": "b7016ec28647feee737fa86f90d09741a91dd37aa17bbffc1b8627fd3b513bf8df48f515f9862295b3576bf1f693a6b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209622, "uuid": "3b603b99-8e4e-4aad-a2d3-ca4f7a7dcc06", "value": "T186D58C577DD009E9C49AA23688B65186BB71BC090F3223D72E90B3783F72BD19D7A744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209622, "uuid": "caecad5d-e0a5-4f65-a64f-c0c0389ea44d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209622, "uuid": "11c0e493-b52e-46bb-aae4-a52b401d2337", "value": "49152:CM38XcF9NPOjKL9a+Kn1ap4If2DmRF1yhWJBVgPGjJI:CM3RPLw78XfDRryWJBVsGjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209622, "uuid": "11d08a78-6fc5-4f51-bc03-7e6e73e329dc", "value": 3019088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209622, "uuid": "c724d5d1-c5b2-4596-a564-9b3d3e687314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209622, "uuid": "1bb0379b-724b-401c-a91d-a5a4dd769720", "value": "SecuriteInfo.com.Win64.Evo-gen.65488933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c1a3d4-78a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783277706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277706, "uuid": "70aabfa5-12f0-48cb-a3a0-67b8c008e9f1", "comment": "Malware payload (NanoCore)", "value": "bbc14a1c2850a01b097521fb0de88de8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277706, "uuid": "1ca1a482-35b1-4c4b-bcac-93a71116c4f5", "comment": "Malware payload (NanoCore)", "value": "17f80f2f3a8b3afe40bc14906e58e0299099c1045667eaf865f4cd99ae06d271", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277706, "uuid": "d205382e-8061-4326-b15c-15a676775194", "comment": "Malware payload (NanoCore)", "value": "f58e11a1a9f8dfa0546b94bebe2b118013edea53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277706, "uuid": "eba6a541-e940-4666-854f-b8bf9cbb1956", "comment": "Malware payload (NanoCore)", "value": "1d339c052757ef076b52c4e26b0787b89a360458782f06d3db1690f70f7d4b57d94496343e38c4b438a8b4b9302e2aae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277706, "uuid": "b457cde3-b070-417c-aa32-29f5d271f291", "value": "T1B114CF2A7BB84A2FE2DE8679712201578379C2E398C3F3DE18C465B29F567E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277706, "uuid": "45e7b6b3-d84f-4c70-9618-99554e1e936f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277706, "uuid": "fc63fdbc-c915-466e-866b-77978c3c20f9", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIk6fdBFvBeiDYI343auG3UBUss:gLV6Bta6dtJmakIM5ydBFvgiDUEszp9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277706, "uuid": "eb4f5175-af15-4db4-8d99-0df6185d488c", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277706, "uuid": "c4342793-fec8-4fad-9399-d6c556a4369d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277706, "uuid": "124e54d5-91a2-41fb-b65d-cc5f76a3ad6c", "value": "f8bet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff9063ab-788f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Blackmoon)", "timestamp": 1783269528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269528, "uuid": "ed27f09f-ed38-41d4-a834-b59db432b004", "comment": "Malware payload (Blackmoon)", "value": "d64b026c606b4646c37007f0547a624e", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269528, "uuid": "abf88ef3-fff1-4b7a-aa7a-8a2b57854bb6", "comment": "Malware payload (Blackmoon)", "value": "194bef1eb8770c78baf6b4fb42b7866943d15c0cb8d96ca9fbed44171ceab307", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269528, "uuid": "678e80db-a636-4134-af8d-d8a7d4a36c80", "comment": "Malware payload (Blackmoon)", "value": "d48c6cc49a69fef7fb3c6008581d2369b11d664f", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783269528, "uuid": "75f1a0e9-313f-4623-80b5-fd56ae34862e", "comment": "Malware payload (Blackmoon)", "value": "edaa21275b4b430bc4ebebf4ddca6f64358d70ab889bbbb219167b50729b029c76966da7f271f2bea4cee9dba77c31da", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269528, "uuid": "ffa1d588-51de-4d36-a903-c508b8e9c79f", "value": "T116563380F6F0C5B7F5FB57FA289B92E639923D25DA78161F3A0D779D857CA00D858008", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269528, "uuid": "11da3d65-586d-4d3f-84b1-92b461f9dff3", "value": "e174a13f7e803015b8bae620450c9c19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269528, "uuid": "9d2d7427-2a10-4d76-a162-9e63e2fd3031", "value": "98304:p7YCH80++s6MM0izSDI+Z3zPHS5/BKfxMEud3Em+cTCu1Jj+H8WhQ7H+wTRh6WwV:pkpQs6Zl+dzPHGOrud0qT31obk+wnwGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783269528, "uuid": "084d28ba-bd32-4006-905f-e357b1496f7c", "value": 6022656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783269528, "uuid": "a61cffbd-64f2-4848-ba1d-9889305ab438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783269528, "uuid": "609d0fcd-e3a8-4649-b970-d3f04ac2f46d", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0f0cae-784e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783241530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241530, "uuid": "756652b8-c8d5-4ebf-9ec3-bcfe113bef45", "comment": "Malware payload (Efimer)", "value": "5744f69e672856a6879875f6118744f5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241530, "uuid": "62bcf5db-b904-4aa9-b712-6bc231ac8cff", "comment": "Malware payload (Efimer)", "value": "1d3699b153b816e2e9129ecc2b5f7dcbe40d5aeee08bfa655d5f01b808d01906", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241530, "uuid": "5a656997-9d2e-4760-a4c2-9da56e597c73", "comment": "Malware payload (Efimer)", "value": "a6bb5b9f1835a0408ede5418fab2505702bc2f53", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241530, "uuid": "5a1025ac-3a63-4304-ab78-e9ac42705738", "comment": "Malware payload (Efimer)", "value": "cc9607e97587fd0f1716afc7f35ceb6eea46fe9fd5f366ea2dda941b1f1c9b97980cf8b0daf87271aefa95e10751b841", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241530, "uuid": "a983dbc6-dae8-4bb8-a00e-32276665b27b", "value": "T196E633207AD111DDE6E3D03C9EE20594E9AE38BA5771C7DF0B9886E41D532908D3EE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241530, "uuid": "68825698-1252-41da-ad41-b4c500ead6d3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241530, "uuid": "3acbd2e5-e268-41b7-bd2f-5ab19ec203e0", "value": "393216:4zk2cC/tbVPo997bK5rXx+BXMCHWUjXOcuI3/PGTAI:442cPEbQBXMb8XjH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783241530, "uuid": "253a6b35-5f2b-4b46-a770-6a4687017147", "value": 14275860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783241530, "uuid": "6ed126dc-59cd-4ed0-99fe-e71f4c38a29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241530, "uuid": "b4071d46-16eb-4234-b3e8-7731c3858f6d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af9cb7d-78a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783276661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276661, "uuid": "af174ef2-6e6a-46be-bcda-802cb32442ce", "comment": "Malware payload (CoinMiner)", "value": "732c45cf433c4a7036bcd4d61132a87b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276661, "uuid": "335a9486-0167-44bb-9317-f71ffea02cf2", "comment": "Malware payload (CoinMiner)", "value": "1fa1e028b2cad5297edcae7d505456d187bdf1bc29acba1e90d17f355951bca7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276661, "uuid": "fc2b3b91-8c4c-4fd3-a81f-8943a4bfc379", "comment": "Malware payload (CoinMiner)", "value": "97930fd057e71ae015bb11088b64c601f641deb0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276661, "uuid": "18617e04-5173-4dea-9566-9c8e3e8d3373", "comment": "Malware payload (CoinMiner)", "value": "84a46a6705aaa4d0bbfcd296ecf279048e948a7a45e20bf22c6477a3f2fd80ac1bfa0fd9170b34f8e0c5bf81e872fe58", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KeygenGuru", "colour": "#5F1EA4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276661, "uuid": "349ff693-bb52-412e-b179-822f1c100f78", "value": "T103668D15BA9A58ADC09AC47482468B636E3170CB0B36B9FF45C482353F6ABF42F3D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276661, "uuid": "63c6d39f-059b-4a86-965d-92346c7e1895", "value": "551ecb3b372a1fbe06ac044eaeaf6b23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276661, "uuid": "2f20bfa5-1061-432f-b2d2-01f2986135e1", "value": "98304:z/MFb6B71KrT1LkLq7c01pn88QZdQLdH+dSZ:sLn1pnFQZeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783276661, "uuid": "86f6ca08-cc02-4f40-a992-86b098dd7dae", "value": 6821888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783276661, "uuid": "e0d4110d-366d-402d-89a5-0fafe10f1521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276661, "uuid": "9ffd25a5-5922-4da5-ba6d-03af9cf02449", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa463fb-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247221, "uuid": "deed79f6-e33b-4697-a799-76347319b683", "comment": "Malware payload", "value": "a2e9ef3eca1a7e561403196727afaf0f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247221, "uuid": "9ca7de3e-7b1d-4b25-ae55-6983b0fc6dd9", "comment": "Malware payload", "value": "2085f3bedbcecc3cf67563dd35d6a856a56f62ef90b69ebf0522fc50e78f3f64", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247221, "uuid": "f02762c4-efb0-447d-b354-b4f73fa4bff1", "comment": "Malware payload", "value": "091a1abfdfe576d3c939a5345e535499e3387fe4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247221, "uuid": "307fa01f-94d5-4527-afb1-f87d491cdd0a", "comment": "Malware payload", "value": "c34348bb779c9e2026a287d3e04051b161cdaa99d1ad431b0ebdf71faa76541042066da952c4c3c22b0c8a5d8bf8a0f9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247221, "uuid": "10aa0c92-9d1e-449a-aec7-dafb6dde50b5", "value": "T1C29139CF03B5867A84EFCEA172B7E9479D0B4D9832D05E1DFA98683666C6D443127F20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247221, "uuid": "1a49d958-9923-4852-8177-8061e707e0ab", "value": "48:/wUQxwuQDOou9OCuvLel2vqJir+FOPtwPnCn/aZ/e24Wt2SWHlIX6/Pirpi1VtfN:4tKnC9wDw9YbwwT+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247221, "uuid": "c13f4cbc-b891-459d-ba38-8dec70c14f92", "value": 4310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247221, "uuid": "080a1b67-273f-4424-96df-180d3c15bfea", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247221, "uuid": "145635f6-0e58-40fe-bead-4b22727c5b7b", "value": "sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0a3330-78cc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783295530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783295530, "uuid": "e12d4585-6e3e-4e7f-a866-b1f56dd39b10", "comment": "Malware payload", "value": "ff3ea7bdcca7e0615f623fc5fa6ca43d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783295530, "uuid": "9adc89bb-cc97-4b1b-a1ec-2ccb0f8c39ec", "comment": "Malware payload", "value": "23dd9adcd564b519ecc6953c402637d7200a565bd939bf990ea70f5bdcd895ae", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783295530, "uuid": "14385480-8236-48d0-bd47-8cffd16d92f5", "comment": "Malware payload", "value": "82fc8acdce58f710a412e948939938e1fcd6e7df", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783295530, "uuid": "d1bb5cfc-90a0-43db-9a40-9cbb0eb9f1de", "comment": "Malware payload", "value": "1304595798675ce9734f7784732c0af55723ca644dc988c99b47acc549b4519ae6a7614e026a60160334afe54bc5e5bd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783295530, "uuid": "b771a714-f528-42ff-acc2-bde0be9ae73b", "value": "T18CE6334892F166EEE5B3423DEEF27651E0A8B4230771CBCB07944662AE731E04C7DA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783295530, "uuid": "4cd99107-cd88-4587-b5a0-c865fb3b7bd4", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783295530, "uuid": "67cb264d-37c3-4901-8be7-bd222b7b6dd3", "value": "393216:IxiL85e+fJmJpWx+GaXMCHWUjXrcuI3/PGTAI:IL8smJIaXMb8XIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783295530, "uuid": "ab7cbdf0-4226-44cc-bf4b-ffdc426f81a6", "value": 14324554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783295530, "uuid": "27e58c66-cfc1-41d0-a5bf-119f9e6f627d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783295530, "uuid": "6da732ce-8def-4072-bf5b-bab62a148bb5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b9fd70-7865-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783251099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251099, "uuid": "c0df2def-2613-46fa-9c8e-27a9b7542cae", "comment": "Malware payload (Vidar)", "value": "67c643519fa0a156145729519285ad41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251099, "uuid": "d6fcbcac-ff30-4680-b0d9-f43f408002ba", "comment": "Malware payload (Vidar)", "value": "247402d2a3bec3e8590798efa1adaae98fde12c194939e1ed4f3d86867ac84a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251099, "uuid": "4d249e3a-1004-407d-a08a-c94b859dd8b0", "comment": "Malware payload (Vidar)", "value": "7345d262270e9bff19859718471b37232d424caf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251099, "uuid": "26777be9-cf0a-4279-a6bb-91736705cc96", "comment": "Malware payload (Vidar)", "value": "0ec79e1895be46b84fd1a3f6b9825b1bc913369145f8354ff563ddf10eabd82fc981e4f3025f961d5c4bf39139c1b6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251099, "uuid": "0a263c92-3344-4402-b4f8-d198b3e82fe4", "value": "T159C36C597793E0B2E48D2371527E377DCDB09E353C90CAAFDF803D0A9E2A190525A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251099, "uuid": "6dc1bc5b-791d-4a09-bd8b-2fc88f2e727e", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251099, "uuid": "5f0850b2-1c21-4e9a-8f55-07184b26d7e1", "value": "3072:QEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXB:z3h0aMJ+Hw3Pgen79/GvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783251099, "uuid": "284e618a-6be0-407c-ab5e-49867fd77d8b", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783251099, "uuid": "ce195f9e-d909-4290-a405-2c67bad8c7b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251099, "uuid": "430264f3-0108-4b5f-ba7a-cf5b4d605c17", "value": "247402d2a3bec3e8590798efa1adaae98fde12c194939e1ed4f3d86867ac84a8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7eeace-7859-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783246169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246169, "uuid": "e24c5160-52e0-43e3-878e-28f46b60b70e", "comment": "Malware payload", "value": "54882170510accc2b72cea6d76a506b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246169, "uuid": "e6f904c5-f46b-40df-94b8-56be3657b21e", "comment": "Malware payload", "value": "2502d5d65411f9aa97c7ba9b3f191d06c160db2320dbc49defc44003b311e32d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246169, "uuid": "66f67589-7992-430f-ad1f-79addc2d617a", "comment": "Malware payload", "value": "f62f1ad8982b9ad23f8fe2a31165f29c0a10e4b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246169, "uuid": "2c8a9fb6-d28e-449c-84ce-17fbda4bfcd2", "comment": "Malware payload", "value": "1b22da8c778a3a59f593f039067865e1e8cb36a93731271971dcce14eeec812e2b64970c00357f99aa99cb4d6715e485", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246169, "uuid": "7fd06a4b-9351-4e6f-a95e-6566a3fb934b", "value": "T1AB08335B1B6792CBC0AF78F925131B22A944F9793A74115BEF6F94043C883EB115A3E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246169, "uuid": "b52bd5bb-74ae-487b-901e-d124a027a7ed", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246169, "uuid": "fbe594f1-a86b-45ba-9506-f892eab24162", "value": "1572864:Jt9IKPMo124iRWYx6ttcpCA21INJGnm2aTEohgwoop7:JUKJ1ERWRttcy8UGTHEop7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783246169, "uuid": "d0361c24-9678-4df8-a9c8-bb271c897a77", "value": 77586182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783246169, "uuid": "b898eb33-8210-4a12-866a-7e49194738bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246169, "uuid": "ae6e21c4-c320-4111-a9bc-c74fb3893cec", "value": "Fever2_Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2025d841-788a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783267006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267006, "uuid": "7b9fedcd-178f-41cf-9be3-0b239e79d9d6", "comment": "Malware payload", "value": "242f25ea4f8670528fbb3d7edfcb2ca7", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267006, "uuid": "2c9f8dff-c3b5-455a-9bc9-cb4c11d9f468", "comment": "Malware payload", "value": "260f2d62bfecd03062c92e53d86b583d171e8f0153de3631cbfc5cc8bb3d10ce", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267006, "uuid": "5ab39341-c011-4e24-ae74-e6f29819dd33", "comment": "Malware payload", "value": "9cc0626a69bcdd5dc016b8f9cef5a0897bdb6a81", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267006, "uuid": "5fa27e46-d4c2-4bb9-9d42-9b2f791b346f", "comment": "Malware payload", "value": "3b60be5fd4f922e5cd674b315c621f0c08da75264450c3120d671fd968453839110571247a920d5bbcef56b290da578e", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267006, "uuid": "f68f2aec-710c-4556-bea1-cfa0645b38c5", "value": "T117F6335DE07E5E53F77A557DB3A82488E298E19A8CC81E2332DCBB96057B1203C4C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267006, "uuid": "71cebc16-6cf1-4d58-9d12-e9e4e8904876", "value": "94990d48d8288ff267b55d7ba19a7fd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267006, "uuid": "b3ee49e7-c608-4cd0-a077-898c9712969d", "value": "196608:Psv+1kYyiNxLbrayk+FWRxsUStG7eUpH8faGzgqK/:PQ+1kWCyk+F0qUSGeUXGzgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783267006, "uuid": "6440a7d3-cfa6-479f-b313-603421f5bf8c", "value": 16466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783267006, "uuid": "b9b628a7-b070-4d48-abdc-2690a76b1d5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267006, "uuid": "9a08711a-f16e-4b3c-a8d2-dbc677cc8027", "value": "Windows Helper App_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f1630d-7867-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783252331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252331, "uuid": "7da5a177-f096-4dc4-bda9-f7936fd4b1d9", "comment": "Malware payload (Efimer)", "value": "eaa8df84423a213566d607532a7c8033", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252331, "uuid": "16dfdc7a-4abc-4d1a-8e17-cb200c858651", "comment": "Malware payload (Efimer)", "value": "28b6748f5efd251c5927c6ad092e3a0c9a0daa3d6b0fd3b5b353e56a551de93b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252331, "uuid": "5d3e1388-b75e-4afe-9010-6249b41bfe39", "comment": "Malware payload (Efimer)", "value": "5c6d63c715b8461e2c42199e0b26b67d3c6c38df", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252331, "uuid": "f0a4951c-127c-47f3-81e4-9a872829be38", "comment": "Malware payload (Efimer)", "value": "a7544689f1bf863bbc0076aef4a030197f8e9f8218b2eb7cd79c62b54433dcfe52bc80b1ff3738997e6c5838b3374271", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252331, "uuid": "e55a30f2-4bd7-400d-9deb-8280b6d73e02", "value": "T18DE63318B5E011FED5B2413DED605A40E6E6B4F14736C5EB8FA8DBE06C9B2E04D3C662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252331, "uuid": "c14e96f6-c4be-4d94-97bc-0f503f9dff52", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252331, "uuid": "82146c7d-e531-4aae-9666-02324fea4b22", "value": "393216:9k2bh7X9XeYOJB7jjOIKvXMCHWUjXacuI3/PGTAI:9kiXxMPjAvXMb8XXH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783252331, "uuid": "8db0902d-6fcc-43ce-a16e-3851e8683609", "value": 14305910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783252331, "uuid": "6d7b1e77-95eb-4552-bccd-1695e888378f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252331, "uuid": "0b45a228-7020-4da5-a061-8b1f4bf74fca", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb25dabf-78a5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783278943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278943, "uuid": "062da810-081b-431f-978c-55e22c8ce05f", "comment": "Malware payload (Mirai)", "value": "455785cfe1be103acf1a0b5a50d80aee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278943, "uuid": "ba8d3700-5543-4999-9045-166284c1caa3", "comment": "Malware payload (Mirai)", "value": "2a1f933e02eb8ffdc3bac67927935dfc04fb27c2a6b2922d38920b39a8bcea5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278943, "uuid": "27c86b2c-b575-4cf6-b986-072ffae2a550", "comment": "Malware payload (Mirai)", "value": "03b2f8babca46acc59d624e09e756c43c3f44753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278943, "uuid": "948df05b-d1af-465d-b118-be2e49615112", "comment": "Malware payload (Mirai)", "value": "a2b4a49b04fdd09a3fa36a00114e68666a19078bca4d779fe1b9c42e62cd18594a8d54de2cc8bd5d7969ad6d43c4fca5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278943, "uuid": "df1793fb-5646-493e-8b08-9943e79c0ad3", "value": "T141B3D84E6E318F7CFBED823447B3AA25A359239637D1C585D1ADD6005E7028E281FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278943, "uuid": "32f227f9-f5a5-4754-97b3-0111a957878e", "value": "3072:p+ncTuR1ClJcdECjgVokaqmZ+68MumWhbTRHcgj:CR1ISjgVokaqmZ+gMXHcgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278943, "uuid": "1e52842b-2c44-43f2-ac2f-85196839a0d8", "value": 118068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278943, "uuid": "374c154a-bf90-458e-83cf-b0d1bf9f7477", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278943, "uuid": "b71eb164-8e14-461e-a3b3-3714851b9c4e", "value": "ohshit.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b905aa41-7878-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783259532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783259532, "uuid": "57c51bdc-3d27-415f-8de0-d8f4a6e07b5e", "comment": "Malware payload", "value": "fc967df8174110b8feb69d28935c0cde", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783259532, "uuid": "bc262014-7783-49cd-9292-4f6842842086", "comment": "Malware payload", "value": "2bd41664eefc605c7e6becd471860d6e82d9cb68ab2bbd69136bbac446e32c39", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783259532, "uuid": "1ca0c307-0000-4097-a47b-5153bee13600", "comment": "Malware payload", "value": "9c736ed9149889f2d30ccb5b12f438ce153ca188", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783259532, "uuid": "94d94564-9c7d-4e36-9a93-482ccf365f77", "comment": "Malware payload", "value": "aa838291a7f8e0ba216eb1be28409dacf56208968091883bc7c57c763757ffa0083b65a6e0f99f1987951c6097cf734c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783259532, "uuid": "b3fdccde-1fa6-4a1c-bdb0-813f258d75c1", "value": "T165E6332816D962EFE5F3513CFEF312A6AC8574720372C28F97688A956E5B1C0097DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783259532, "uuid": "8f338ee2-1a9c-4551-a561-6d16ed007910", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783259532, "uuid": "a48e90e2-a99f-45e4-a08b-fd618d4ae7d1", "value": "393216:GC3yLshpS+ld0EwXIsQS59XMCHWUjXVcuI3/PGTAI:GQiQd+QY9XMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783259532, "uuid": "42b4e9bf-aef9-4573-b5f1-1644bb602411", "value": 14287760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783259532, "uuid": "cb29a747-7cc6-4e8e-b919-203c607b62e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783259532, "uuid": "f5e66cb9-b511-436d-8418-d6bf015b4134", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e4b0a9-78a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783280146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280146, "uuid": "e70a1597-91d7-4d76-a3e5-a39d38129159", "comment": "Malware payload", "value": "90c812e148e51a814354a653ace62d12", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280146, "uuid": "348fd83f-9406-4825-b122-d5a9387e9018", "comment": "Malware payload", "value": "2dd4d446f497e329b73de552b60f219c1c5adfbbdbcdee9e051143dbe21bd8c6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280146, "uuid": "89332f27-b119-413b-be3c-0cb0edf26bc4", "comment": "Malware payload", "value": "292f4a7243cceab9b4dc40c641a2ba29a031694a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280146, "uuid": "1e564bbc-c516-40b3-b580-725c27acd0ae", "comment": "Malware payload", "value": "5713fc6f2f7daf19ef439f1345be0e5172979ddfa2ceb56a708385a3f46a3c10c6aae8b284e22f40411885f5dde72d02", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280146, "uuid": "62c58844-9224-402a-a3d4-1d952bae9ff1", "value": "T1DA01ABCA8000AE4050EEC61E329760A8F810C3CE559B4B78BF5C2D7AEB98C04B036F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280146, "uuid": "2fd2a244-02c1-477d-82e2-cf73f28f3be9", "value": "24:kXCKysE2hi0ziQvZohanVmxZIX3p21D4X:e9Qp+MsnVSK3pOMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783280146, "uuid": "b2f6ff0d-78ed-4dd8-91d9-01dac9b9cdb3", "value": 836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783280146, "uuid": "fdee4cc4-9932-4ea0-986f-e4504f5408da", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280146, "uuid": "5c1ec85b-e1f5-488e-b068-6a99db94e728", "value": "lil", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9682e9dc-78a1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783277083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277083, "uuid": "0c10ee70-3269-4a19-af5f-5a06289d8e01", "comment": "Malware payload (Mirai)", "value": "b7da6fca8a950db67aaedf2d63736a23", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277083, "uuid": "a4d16357-dd71-48f0-9400-9ec15108900e", "comment": "Malware payload (Mirai)", "value": "312bb4b56891ada2d7d3b7e58c1e6191440d6421c03f1dfc26cb27e0ef3a06ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277083, "uuid": "3e68962a-2190-4df8-9cf1-7c9cdda07115", "comment": "Malware payload (Mirai)", "value": "ffd06c73f8242a09e86204f6810dc75e40906093", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277083, "uuid": "8c5cf5d0-0927-4e77-adfe-d106a2e61ca4", "comment": "Malware payload (Mirai)", "value": "b8c38177f39902617e3427d8700977173e1049d01b667928deaacfa0a1674e928539de35b87e7f48f7f02728f4d6ec9d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277083, "uuid": "e4540342-4feb-4a1f-a9cf-f654340cc01d", "value": "T130935B22B5391A2BC8E4947612F75322F1F6478A14B88B1F7DB10E8EBF245D03A477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277083, "uuid": "0524bfc4-cdd2-4eb6-9b6f-f880321f889b", "value": "1536:mco9F6LYqitt+y95zBA1keTnI/ltvXXYm5hRsQDEYttcUn:mxGUIDoVnYOhGScUn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277083, "uuid": "dc7b3359-559a-4ab8-a253-2c2afb911967", "value": 92888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277083, "uuid": "8bf195ba-72f6-4203-96d5-bca6e433d5ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277083, "uuid": "c1ac3374-0432-4d0b-ae56-99cca4399cc1", "value": "ohshit.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f69083-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209626, "uuid": "f01cdac9-00c2-48c8-ab41-bf184dae0bfd", "comment": "Malware payload (Vidar)", "value": "9af17b2049b920cdc6729948eb7e625f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209626, "uuid": "669b6d90-d6e6-43a6-b001-e2ffc576aea9", "comment": "Malware payload (Vidar)", "value": "31da18115d031c335b2b4f2b2d3a1277ace95a139e7293e469ee2f55d084d3a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209626, "uuid": "f81edcdc-cb93-47a1-a6ac-edd645133013", "comment": "Malware payload (Vidar)", "value": "911ea308dddb874b517885a9909f029126a54aba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209626, "uuid": "556d2a44-cf60-4a16-8a82-424545b5ad47", "comment": "Malware payload (Vidar)", "value": "dcefffc562f67af74a980a10fe16dec476cb0f71a425b30c158f3c6924e030edf3b6e3ae76564512cece49b095539242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209626, "uuid": "d48c528b-980e-4d9e-ae2b-2916eec6c479", "value": "T182E59D0B6CD249EAC4AA673289B615927A75FC154F3233D72E90B6783F727E48C39740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209626, "uuid": "746ad781-40ca-4bfe-a041-feefc2f612ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209626, "uuid": "25c915eb-73f2-4b59-9fa7-1ac9e9912335", "value": "49152:Md20uoiCzddk8L215lj5D9dhupmLAvy+BiMQoNrPyVovkkrgwv:MdkoL2hdmisoiPyGvkkrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209626, "uuid": "4bf83dc6-2e12-40ba-a454-e8f0eb5a2a42", "value": 3021656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209626, "uuid": "94715a83-5c4a-4db4-b5fb-a9c979e5d9f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209626, "uuid": "195295fc-c8e5-470c-8c6a-032c995a368c", "value": "SecuriteInfo.com.Win64.Evo-gen.38397872", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774278f4-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209600, "uuid": "29267054-9077-419f-8cf6-28670a6b3863", "comment": "Malware payload (Vidar)", "value": "2344b27221e13bd6fdae3cbf1d71dbd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209600, "uuid": "14fc43ce-516d-4557-a5e5-7b6bb447bc48", "comment": "Malware payload (Vidar)", "value": "337463ea7d1ef14be117bf0461be4dd342794f5919c820173651b9d7a7269ae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209600, "uuid": "7117f906-139c-46d3-83ac-c1b34889da02", "comment": "Malware payload (Vidar)", "value": "a87f3e023cff230f8b4bdfa7945e4e43dcc2c0c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209600, "uuid": "0ec74cff-d95b-493f-8e43-a660d6ed4281", "comment": "Malware payload (Vidar)", "value": "1f02ff9f92dc7ed83d7f056f402c4b251a44806badba555a105c359f8689d6ce8912779c1146d2be20a536e8dd662398", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209600, "uuid": "4143a233-f25f-4252-a673-ff487f9ed4b4", "value": "T156F56B47BCD148E5C09AA33289B79296BB75BC090B3123D32E90B7382F76BD05D75B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209600, "uuid": "557ed488-cd3c-44ac-bc49-1f21ab6a49fc", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209600, "uuid": "999421f1-62c3-4f14-844e-99eceed2a6b3", "value": "49152:WH26pOTjiRIAYE4RsCnm9TAVMamygFn0ggCsDpYpPHi:WRjNVjyk0KPHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209600, "uuid": "0f95ddbd-ae93-46e0-88b4-1e6eeef64987", "value": 3349344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209600, "uuid": "eabab519-4bcb-4211-96d1-85836b2076ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209600, "uuid": "d6e82bf5-521a-4f2e-a13b-8b8f2f19253b", "value": "SecuriteInfo.com.Trojan.Siggen32.61853.5418.11599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bf736d-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209616, "uuid": "8cdab454-de22-43db-bfe7-1967bdfb7c68", "comment": "Malware payload (Vidar)", "value": "fe8e6273c6c4ce33dc5506a497c60a16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209616, "uuid": "e6020c02-c067-4da5-8cb6-1011e91bd391", "comment": "Malware payload (Vidar)", "value": "33b317b7ffc3ea442add1da7aa7a7c444b670c62943e684c2ec2c5d6fa97904c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209616, "uuid": "c877dd82-d01d-44ce-aa96-7b2e6b955138", "comment": "Malware payload (Vidar)", "value": "47ecc87cb6b4effe354e194e6338886769157795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209616, "uuid": "aabf992f-b5ad-40ae-89c5-388c1baf285a", "comment": "Malware payload (Vidar)", "value": "c6d2ea0413608f25d441a2c5d107f0e99c96a6e456bbb8766ad4899f2cf4c8e7ec0d91ca277a293f2fd483a8beefd182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209616, "uuid": "7bcc280f-a508-4061-a150-6748083da8c1", "value": "T136D59D4BBCD148E9D8AAA3328CB611867B74BC094F3623D72E50B6782F727D1AC35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209616, "uuid": "a27f243b-149c-418b-81b7-ae2c709bfa1e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209616, "uuid": "57082e3b-2688-4ea1-8d51-12b359b2c77d", "value": "49152:EjO+4rvfjF7d1wAv65itXoG4WD5e7UlRHGOD9GCg9:Ej6jUItXo7WkkhGOJGCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209616, "uuid": "75790885-ff9c-40eb-be1e-303451bbc902", "value": 3005824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209616, "uuid": "1b513b03-cb10-4cbe-942c-febcc9e388bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209616, "uuid": "ad8b7bd7-8042-4da1-b806-d7f055daeef1", "value": "SecuriteInfo.com.Win64.Evo-gen.49954333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41df5d0-7857-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245457, "uuid": "27193921-0e8f-485f-8f4c-131e55830ce0", "comment": "Malware payload", "value": "4570c2d1990405c0497e76dfa31695b4", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245457, "uuid": "61fb5db1-38da-4ed8-91a8-33c621fed6a6", "comment": "Malware payload", "value": "34aafc29cafa27ebc47e559eb021d5644560e77c4790139f22f180b5b0ef0553", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245457, "uuid": "9b3f44e2-4b8e-4387-9b34-7836755ac755", "comment": "Malware payload", "value": "24f6062a205787cf30ba0771e19f03dbd60d454b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245457, "uuid": "801eb65f-5b7a-4a4f-87cc-433269e28437", "comment": "Malware payload", "value": "980cd79059e44b00bcdca787e7f4cc4232d0e241d2aaf04c05a7ccc736438395ddbbb46101362638381e059bcae5552d", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245457, "uuid": "77ea2360-7c81-4b9c-999c-1fc12f60e2bb", "value": "T1DD0833392875C6BFC5A634F7156CECB6C358C0437210617D2A6A4768628CAC2A4EDDFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245457, "uuid": "c412d670-5b63-4724-b42b-e289950e8be4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245457, "uuid": "57c06ecf-4867-48c7-84d0-0e48d5223e3b", "value": "1572864:et9IKPbc/VChRWYfYeR31cLpb4YbfqXxODpCL2cW7:eUKw/4hRWEr3Up0CfyOBcW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245457, "uuid": "1942dae5-d8d6-4008-a2f8-931881f8d449", "value": 77608007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245457, "uuid": "b9b22358-d16f-4955-afa7-cdd084fb4fb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245457, "uuid": "83754b40-3ba4-43db-89bd-4998ee490687", "value": "krnl-v2.724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9452700b-7852-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783243149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243149, "uuid": "239416fc-673c-4538-a7ab-8e0506efe8a1", "comment": "Malware payload", "value": "04b507a87b9dc2ea0d2871491d37d5b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243149, "uuid": "4c006202-49ff-42e3-8d52-706853ccaf04", "comment": "Malware payload", "value": "34f0e8a8ef08d3ef4636c51d6b501b414b831b3060c04b5f2d87e9ec1d9129ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243149, "uuid": "94c4b7a2-5090-41fa-92ce-c4c58b75f965", "comment": "Malware payload", "value": "35739d4d2221239d0b8998c5593abe0c0f04f61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243149, "uuid": "23c41e6b-c71a-489e-bc42-548425c8d669", "comment": "Malware payload", "value": "22cdb9a08da524a378853a0b3bcf4619f5626ed83e063f2b08d183b96aabb3fa38b2545a9e5a15d5a396e5c6deb7e77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243149, "uuid": "cbeabe07-8692-4a0e-98e5-23f770d7938b", "value": "T196F5291599BC0D6DE73729BCF86E2986DFCE8062CB42C06B3578C7D527E66C04A1CB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243149, "uuid": "d222c37b-d896-4d8c-adbb-ae7e97e7ec07", "value": "c9de8759d85c8ed1f1deb14136eb8331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243149, "uuid": "aaa52ca4-6df5-4729-859a-16a98036858a", "value": "24576:xBjH+GQ2f9Q0MOPBGMlKu2EA4qLZOEcVHN3YZD73R:DDMOJG0KZ4AvGtYPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243149, "uuid": "c1d53aa0-70fa-4461-b369-8014f5d38928", "value": 3354640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243149, "uuid": "5c18f9cb-3a9d-487f-9baf-04da800528a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243149, "uuid": "ebda6543-8c92-4287-ab77-8b96d6c86d08", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88197302-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209628, "uuid": "a5fd78a5-19a9-4fc8-a551-ba688b08c280", "comment": "Malware payload (Vidar)", "value": "eaf137a95d93a9093efc6280adaf9326", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209628, "uuid": "d8dddcad-ed6f-4ca7-8d73-f914843d1f50", "comment": "Malware payload (Vidar)", "value": "360e3c6d428da649c77a426d3f0379a3a1eced35f0d7a68f5a925d4b300ccaf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209628, "uuid": "12073bc0-133c-4ca6-ab70-5903612352dd", "comment": "Malware payload (Vidar)", "value": "4119957c3a2100afdc5eda40c89cdb2f426abf7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209628, "uuid": "f1a40252-d394-477c-a62f-b44023dba266", "comment": "Malware payload (Vidar)", "value": "71f5a602ca6c5f53fae004ddc73ed5753186411ca8e6b54144529f132bb43477b8c133e6f0ce4479df7bcc7f8a594098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209628, "uuid": "66f6d48b-cda8-4fd6-b069-cadffc090034", "value": "T16DD59D076DE119E9D4EA963189B642A67B70BC090F3633D32E94B3782F727E14D35B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209628, "uuid": "a548eb5c-1e63-45a2-90c6-fc0fff2775df", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209628, "uuid": "a625aaaa-e179-4da8-8ef1-23632d160a06", "value": "49152:JQVuTmstSRhlmMA5kEg8QdlL1/oOxMFnH9/n4wEoszogn7WXlBgUt7:JQu6s/g8QdlL1/oCMFnHVn4wEoszognG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209628, "uuid": "99f0f78f-f733-4df8-be36-9d892d09b3c3", "value": 3015520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209628, "uuid": "7e09aed2-aa70-4ad3-a25c-d711623a5bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209628, "uuid": "7452a189-0957-428b-9b7c-4b42f80affcc", "value": "SecuriteInfo.com.Win64.Evo-gen.57237154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd5a822-7846-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783237961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237961, "uuid": "0e2ca800-afe6-46eb-8d5e-a624202d8a30", "comment": "Malware payload (Mirai)", "value": "f91f8726cfc678d79c6221a84cb249e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237961, "uuid": "f4d3dd06-5a7e-4abe-aaa5-e59507e64fd8", "comment": "Malware payload (Mirai)", "value": "38d080d854d541bea1607a4da5cef9ff174965ba471570df9519cefaff912dc6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237961, "uuid": "abc9e770-2d9a-4b7f-a1ad-af00ff4b2c64", "comment": "Malware payload (Mirai)", "value": "75bf97f2a2614c12fed776bae5c3d79361065a5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237961, "uuid": "f00e0e97-0b72-4de4-97ca-97fdf6490200", "comment": "Malware payload (Mirai)", "value": "532e3c2ea4b9ba352791eb63633fe3f6588bd89b992c584a309f2c59124a1f18f1804d6ce5a19b88fd7ef3b0c8becf17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237961, "uuid": "090c4030-14a8-4828-8f30-f8b5b92ea8d9", "value": "T11F143A4B77208F91D379D53009F38793BAAA269216E2D985E36DDD003F6435C682FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237961, "uuid": "818a24d6-c0fa-48fe-94a2-7f76fb11cf54", "value": "3072:zWIPGb1g0xiaHDLQNyIqr3rhzXyapyyTqe/Q4+UYj53:zWKSxiYDcNyIQppbt/Q4+BV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783237961, "uuid": "56139197-a190-4dde-a734-725ef30c0137", "value": 196924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783237961, "uuid": "6280f712-f2cd-458d-add6-5137cf26889d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237961, "uuid": "83912f0f-6d51-46f4-8475-d4c1a83c0111", "value": "dg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f18d25-78c2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783291089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291089, "uuid": "9b4a7dd7-5c2f-4b73-9677-6bb3d6c4d2c7", "comment": "Malware payload (Prometei)", "value": "61933a1f8bf35290ce1db28ce35aae8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291089, "uuid": "8dd10873-1a59-4b59-a446-918f69ef38fc", "comment": "Malware payload (Prometei)", "value": "3b4345d443ac5791092635b18a847d1db3aee953428d9ad04dc01f82478ee2a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291089, "uuid": "39a25ca7-ed54-43a7-a54c-a20f4584a877", "comment": "Malware payload (Prometei)", "value": "636f62541dc01add12eb60d2833ec9fd84541dfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291089, "uuid": "f14d6081-25d7-4f67-9554-f48650f2e2ee", "comment": "Malware payload (Prometei)", "value": "6b3da45b08390ee087589931354ac9cb1f2866dd5bd5b503840eac46284d63ce6e544c0ef535de21391408ab7e93b639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291089, "uuid": "30d18c9d-972c-48e1-ab3f-fda22277623d", "value": "T15BA423B4F9219E8F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291089, "uuid": "b71d2f51-e654-499f-94b8-32861ed4b050", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdq:Fs6pyCC/Ya2hpi6T6N4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783291089, "uuid": "2c9de904-0cc4-4210-80a8-df714b789701", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783291089, "uuid": "ceaed21b-b101-4280-9e4c-d3d248c2c344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291089, "uuid": "89f4adbf-214b-40b0-9a11-756988bda146", "value": "3b4345d443ac5791092635b18a847d1db3aee953428d9ad04dc01f82478ee2a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4add1fba-78a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783279963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279963, "uuid": "95f95799-07b9-483e-93ab-6510d8d1f590", "comment": "Malware payload (Mirai)", "value": "b3f355d5f468e1514a9da3c08c775256", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279963, "uuid": "1bf21eed-5def-4580-945e-2c3b2380f46d", "comment": "Malware payload (Mirai)", "value": "3c79d4fb9210a9fe2d202cb35eea82f4b0af46f8f34418e44bf10f2b65b862d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279963, "uuid": "f2782c6a-7e1d-4680-86da-35db3e6ac847", "comment": "Malware payload (Mirai)", "value": "1cadc87ce929ce9b4633fc3ea5cd19e8be776067", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279963, "uuid": "55699b49-6847-4388-8c9a-a299c968481f", "comment": "Malware payload (Mirai)", "value": "42aba599d73f7e4097fc5d19ca7b37301b8e2902aa7d8d3d4b1df296a9f169ef8253fba8c0cd4ae2c6550b1cd5b68f52", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279963, "uuid": "66b5cf70-bd35-43db-9932-7b1d196ef366", "value": "T151834B0173480D43D1A71DB42A3F37E5D3EFD5A022E4BA89654EDA4681B6EF3254AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279963, "uuid": "2bdcba5a-b77a-4415-9331-0ef78859b629", "value": "1536:aXPYgAumBFZgrWZ4oG/h3FiYKpQXLtZ6280k:aXPTAumBj5sFPKoD80k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783279963, "uuid": "ddf7af75-ee4b-412c-93ce-16a0d7a5d044", "value": 88632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783279963, "uuid": "4f610f38-609c-4f36-b187-5d121fb54ce9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279963, "uuid": "4b4ef1fc-dee8-4af4-ba24-d5bcded17141", "value": "ohshit.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce7b891-7846-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783238171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238171, "uuid": "a8828b9a-b677-438e-b926-323da668a4dd", "comment": "Malware payload", "value": "39bbdf3a92ffdfccee7c0ca11c2b4b3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238171, "uuid": "002fb8d5-fb35-4644-aabd-8f06c453e286", "comment": "Malware payload", "value": "3d0a4e759400c2ecee466958de1803ddc4cf901d5d06a72d655b698725fc8826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238171, "uuid": "9ca844a0-5823-4960-969a-267cd9af6947", "comment": "Malware payload", "value": "38d9cb5bed885640e0b3350cd2f4386e46985fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238171, "uuid": "94d3edcf-5da8-42e0-b0f4-03fccba9d757", "comment": "Malware payload", "value": "f6364ff1b3ec4950f301a80fbe77b62b5a36213795798404cb5476da1c3c8657c7f0713919df8f100176f9e76182fcb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238171, "uuid": "2425cd43-e1ab-433a-afd4-c8e5bcc7c90e", "value": "T1CF053A27B298653EC4AE27354673A05058FBA66DF417BE1677F0C88CCF660C01E3EA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238171, "uuid": "4fe617b6-b0ba-4252-9e73-8a86293c21dd", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238171, "uuid": "d98a9465-162b-4520-a4ad-007e3dfe720d", "value": "12288:P3N5fEsP85ymr81c0r+BviLffL+4aj5+Qaf+6Jk35:PTfEsP85DgJrivY05+Qa65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238171, "uuid": "6c844441-560d-47f7-adf1-499b640a500e", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238171, "uuid": "aa4e2ed4-edd8-488b-9ea9-1a14f9834ee9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238171, "uuid": "fc024431-c0ef-4c07-8f63-7e2e867fc878", "value": "3d0a4e759400c2ecee466958de1803ddc4cf901d5d06a72d655b698725fc8826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34552ba-788e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268998, "uuid": "713fa6a7-7350-4ba8-9e3d-ac892bc762b4", "comment": "Malware payload", "value": "fa9dca979d6868a67fff94f6c25d9a12", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268998, "uuid": "aac5016c-20f5-486e-b7bb-967d0b54fd72", "comment": "Malware payload", "value": "3d34a2ce97a2b85ac3788516071a25935adfd7f658f17876ce3833b22d3348b9", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268998, "uuid": "6a267e89-559c-4e51-9da5-91bce82941e3", "comment": "Malware payload", "value": "c6ea6fbdcf679b22e23eb817c9759a070aea2660", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268998, "uuid": "2180b20b-4c4c-474c-8b07-93108dad5707", "comment": "Malware payload", "value": "fd2033c01a923e0f3adb45962da8a8ebfa6a8984580d1071d4ca86a904ed836d342f409d83efd342db5652188a02229e", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268998, "uuid": "b14587fd-761c-4804-92c6-5d4c71c3fba6", "value": "T14FC7334CA7A9025CE3D34EF7A899375DB0725A49E720B32F4BB805457C63BB6071BB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268998, "uuid": "b40922c9-1172-4a1c-b72b-b4222c1e4539", "value": "1572864:ojqHtD7yoPxm/u7cQ47AjIiwH5kLvY7VvZQZX00:3Eo4rQ47AjVYk6oF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268998, "uuid": "34904570-1fe5-47ab-b972-d5a8c9943b98", "value": 57942646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268998, "uuid": "72eca5c4-da61-44cb-99a7-f4a32077e31d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268998, "uuid": "d9f7f8df-8e50-422a-b39b-7ddaac8e2934", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42f8e11-788d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268623, "uuid": "3013e442-1b87-4f84-a85b-03e98cfdc054", "comment": "Malware payload", "value": "2ccbfdf836c379b5d6b46731b3a30005", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268623, "uuid": "e79290da-767a-4eb1-96e3-cd67668172ec", "comment": "Malware payload", "value": "3dd9f02c0c2dfeeeba8ea1fddcde78b05728d08574e613aaf9be882989c1581b", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268623, "uuid": "b9fdbc63-0f8e-4a63-9971-c9a741fc6d03", "comment": "Malware payload", "value": "86e0db406d31521e83549f0c3f0d4861d675deed", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268623, "uuid": "88acd29d-c863-4e1d-9fc2-2aacf69a718a", "comment": "Malware payload", "value": "afd420732178c602250ec4b62de6d3b061235ee6aa07c82d91915ef07e26be58a55c766a7ff6923b441b7918f74f4165", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2024", "colour": "#9B70E3", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268623, "uuid": "d4f59bf9-67bc-41cc-a98a-7d4d2c763042", "value": "T157D73359FF8D006CEB85AEB2EC9227B9A4B1C20E8766F51F996C15D11CC27F25307983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268623, "uuid": "3020846c-cbdb-46d7-a95c-f0cdf6cfa77e", "value": "1572864:DAua7xj6X8Boh5reoqZgqUKilOdRYcfKJZyAK:C4XyobXbKigdR5fCZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268623, "uuid": "c18bb466-41c0-44b2-b75e-665228c3c93e", "value": 57976699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268623, "uuid": "7acf009b-b9fb-40f4-b3dc-89f30b8a17b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268623, "uuid": "b51fd1f2-a247-476e-9876-ca2fa8a89ddb", "value": "#Pa$$w0rD__2024--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f915a14f-7846-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783238164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238164, "uuid": "03d8bf85-bff7-49b6-99cd-b4f21bc1be71", "comment": "Malware payload", "value": "54738308f6a1b70a6b3bba1d6e671c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238164, "uuid": "735fc9e0-64ba-4f3b-9fcf-82a72aefd697", "comment": "Malware payload", "value": "3e37f561e234de2a66391a708f3d73546247d6b85b0c21e5c341ceffb9f9719d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238164, "uuid": "5c29779b-d039-4ff6-8d5c-8283eccf1980", "comment": "Malware payload", "value": "ff815df3f776fb0d909f2d850d319bbdc9a82019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238164, "uuid": "0609d280-192a-48a4-b004-5af1f87b455d", "comment": "Malware payload", "value": "3fcfc8903d9430ac51cc7ff3a8cffdf0f894ccced188fafebab9e568e091619e84165efcb67ac322c40997a0cf320144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238164, "uuid": "2784b53e-ba4b-4d07-93b8-e675eab2bfbc", "value": "T170053A27B298653EC4AE27354673A11058FBA66DF417BE1677F0C88CCF660C01E3EA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238164, "uuid": "b80c92f9-b930-40c1-a126-b54842e11129", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238164, "uuid": "f1fcec41-8623-4bbb-bcfc-49234986c5dc", "value": "12288:t3N5fEsP85ymr81c0r+BviLffL+4aj5+QafL5Hk35:ZTfEsP85DgJrivY05+Qao5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238164, "uuid": "5e5b140d-d85c-41a1-b23d-17105ef3ccf3", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238164, "uuid": "f873d375-ae18-41b2-a89b-d6980c256a4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238164, "uuid": "f7f00b05-bba2-4193-94ee-da4a36b7c229", "value": "3e37f561e234de2a66391a708f3d73546247d6b85b0c21e5c341ceffb9f9719d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fd8c25-78af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783282964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282964, "uuid": "0b8a6d5b-3b32-4f14-b2f6-c1b81cbf37e7", "comment": "Malware payload (Mirai)", "value": "1f863b97c9b4a1f284846340e23c3fd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282964, "uuid": "6eab1983-2542-47ec-9cd4-9d526c2f2a2d", "comment": "Malware payload (Mirai)", "value": "3f46f24356ee0ca1a8147a0deea5a584870bb1d99f3fcc996ced516830148778", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282964, "uuid": "aebf08a4-512d-4b7c-bd82-81986acd9278", "comment": "Malware payload (Mirai)", "value": "26cf4d912dfc533cd2ec0828f6f51ade70ca5a36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282964, "uuid": "9aa35643-6117-4d5c-9050-7789c6c3ee4f", "comment": "Malware payload (Mirai)", "value": "b919d8e945528b956a1eecfc271a07953720eb3d0dacc345870d365e08ed86790e3dadcd5e9281352edb198299818dd0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282964, "uuid": "3e715be8-2325-4aad-8257-b3180702dfd7", "value": "T1A8430785F8D2856EC5D4177AAB6E328E33A1B7A0E2CE3217CC584B2137852CF5D66B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282964, "uuid": "e97244a0-d4ad-4599-947e-afdf1b284e74", "value": "768:2lyA1VaKLrJzBNbYJFEGFls9O1yvIcDVTwYqI5SQ1G4UWIYQ2nReHob8XyMZBNtu:2pT5lNsJWels9qEjZxSK1Q2nReRCYK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783282964, "uuid": "3066b327-1986-499e-a31c-7e10fb139539", "value": 56916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783282964, "uuid": "0f8e5394-16e4-428f-8a77-90e5493bbdb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282964, "uuid": "6328303b-79ae-42d1-aa2f-203d4508d43f", "value": "ohshit.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7f9975-786a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783253288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253288, "uuid": "3ccc2a80-37b3-4034-868d-bd2eb10aaf3f", "comment": "Malware payload", "value": "ef1d1b58fcf52a61c232c8613285d443", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253288, "uuid": "a8be8916-4bfb-4049-ac75-ac21fe0aa432", "comment": "Malware payload", "value": "405a648bfa1db523bca73dc0c7ca39b1c4f31c98ee3a2d73c8e0c0f580878eb5", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253288, "uuid": "d8e07d49-d713-48c3-b648-0b6f206787aa", "comment": "Malware payload", "value": "9856dfa4b2f7b2d24cea39bf837f11568fd36f0a", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783253288, "uuid": "aab85a89-6639-4975-976b-ce0a1db20265", "comment": "Malware payload", "value": "e578656df066009d39a022852f8e70672068df937d48617e2ae0112b3d9c9c3e2e743ea8d50bc35ba1290b08cc313cff", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253288, "uuid": "89f38443-26d7-4553-bc5a-454ca95b34e9", "value": "T17AE58C06BCD108EAD4AAA6728EB651827B71BC080F3667D72E90B3783F72BD05D35715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253288, "uuid": "55033d74-6683-4621-8450-0824f4fb3817", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253288, "uuid": "667b2674-9435-4254-9c07-430bbfc4d0aa", "value": "49152:4hhYx/isubQ1vawbPauxcFW0dzUhZsmpHnX4jiKi/JCI1:4hmFbP50piZXMiFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783253288, "uuid": "c80c6377-31fe-4ca5-8a09-2818c1781d17", "value": 3082592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783253288, "uuid": "12751f49-56af-42fb-b0bc-da2c263aa084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783253288, "uuid": "02cb22de-1035-4632-9ee9-d2fb47924dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e775221c-7882-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263904, "uuid": "042e8268-1ed7-4f3b-a572-80a69d333ce9", "comment": "Malware payload", "value": "862e9b5ed5f0a65d554fc35dc2d60ebf", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263904, "uuid": "1990831d-3099-41d0-b55c-75ea72e7728d", "comment": "Malware payload", "value": "40e63fb01ae2ac23d95a7aef25459cab4c36a399dee921c2159326a74fe6edd5", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263904, "uuid": "184e9f89-c8a6-479c-b713-976e0623933f", "comment": "Malware payload", "value": "23dda7a090da286a2d0149b40bd9462f24baf67c", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263904, "uuid": "f124ad7c-1209-4f95-8a95-c3e54e60bd5b", "comment": "Malware payload", "value": "3923e42c3e4f50d98b112136944b1bc601af1c00bee68e72b440c895ddd77635d388f83ff3c4da7cd496b9dc2e778902", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263904, "uuid": "990b75b7-2fc1-4210-987d-15238a9cf0d2", "value": "T16357015AF61CD42BDDE9B0BCCD8F17A3B52679150A10C1CB2822860DFDA37D49B25BE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263904, "uuid": "96d7f240-8202-4a48-8f72-26d208141819", "value": "786432:suV+C+2HuT1AKAWLv1WlrB4DLc2xyeQ9cFv4uRM:suVSx2KElrB4DfBWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263904, "uuid": "665d5243-fef9-48cc-92f4-4a967564232c", "value": 27472619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263904, "uuid": "c2343480-7053-4df1-b647-47e899316a9e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263904, "uuid": "c0bfd780-2eb4-4a1b-9ee0-4b3aee2f4ffa", "value": "com.pumped.smsgogo_28.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b1ab51-783d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783234260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234260, "uuid": "bc2dcf79-3cfe-4f64-a2e9-ccc73afd2069", "comment": "Malware payload", "value": "adbec6b09e5db5cd349f31e4e7a9b9b1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234260, "uuid": "eb1507ee-0b50-4378-be25-138428a4069d", "comment": "Malware payload", "value": "40f52445a7b6481d9627a4f907422d9566357a3fd2f7d3e817c41fb606e87a2f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234260, "uuid": "604d914a-8147-49be-ad77-fd10d61767b5", "comment": "Malware payload", "value": "4cf28b996e75a43bbdce70fe225218d0d5af1f3c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234260, "uuid": "4f639013-c8b3-469a-8b63-9da41b451f5d", "comment": "Malware payload", "value": "86d9240198866f26d791cec8ff375115182617ccb51ee27ab3d1a2a54e9cf57b94603f80168ea8242ff233f13f97f9b5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234260, "uuid": "de4390c8-a5be-4719-9490-25568f7a7fe0", "value": "T1BA236C6516817C24AA98D4371D7F2F0CBDA983E6320492DDBFCA3CF28C59A9CD11972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234260, "uuid": "b2d1f9f2-fa23-4819-aa3e-877095858617", "value": "768:IXRWNGxVB9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:clxYcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783234260, "uuid": "b6304be2-dc5e-4e79-8614-8578295bca1e", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783234260, "uuid": "0e1f6db3-98a0-460a-8aff-2b355b84edfb", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234260, "uuid": "01a3b375-2b53-4654-addf-41a063737143", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85069220-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783219931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219931, "uuid": "c1205622-9eb4-4b89-826d-2a41c73a0fd3", "comment": "Malware payload (Efimer)", "value": "99755cc0b98e663e73aac9be9aa33c13", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219931, "uuid": "4e35e242-9c7a-4fdd-ab6e-e603c2a6388e", "comment": "Malware payload (Efimer)", "value": "422c55e0219b09d0262782b25420c601304f5d1b46a325f2b4859ef77244ff42", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219931, "uuid": "d74c0c5e-e655-42f0-aeba-bfcb9eb59ed0", "comment": "Malware payload (Efimer)", "value": "116af423f975819cd0668484d7e0fb7c83460fb8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219931, "uuid": "4d0f48bf-24cc-48bd-9366-fbdc81ff15b1", "comment": "Malware payload (Efimer)", "value": "1e68754c7a75f002e349aaf2deffe72df03e71a049307d0b8aac8602a99f3456e5c6a2f8cfd1870aec4b853d6f23c7d3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219931, "uuid": "9def5127-de9a-41f8-9c0f-12660a8fa8d2", "value": "T1F4E63359A0D001EED533843CFE6185F2D56934A95BB2CA8F1BD4D3E1BC5B2E04E3A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219931, "uuid": "d899d40f-cbdc-4fb7-a149-cbee26de7284", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219931, "uuid": "cb86e0d6-86a1-4e1c-b78f-9e28fa76f52b", "value": "393216:WcPtPJhURu1YY0WpZYmPxz48ITXMCHWUjXWcuI3/PGTAI:Wclf9R5z4zTXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783219931, "uuid": "8fb6c8cb-9bbc-493b-8557-a980b9c1c185", "value": 14278851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783219931, "uuid": "e9c758c2-e4f1-4730-aef4-07e1b291fa11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219931, "uuid": "9eedccb7-edc8-4417-ac24-d031820562f7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f45721-7857-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783245138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245138, "uuid": "c53a4b04-dc89-4204-a636-1045dde3ae62", "comment": "Malware payload (ACRStealer)", "value": "db5566d48b5cf91abdd36ec1c3a07612", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245138, "uuid": "e0b08154-053d-410e-a312-6ce37690b40d", "comment": "Malware payload (ACRStealer)", "value": "42fa6071fd7cf7ac8ff6740d6c297f5b8527a93116f84146a515449070abf488", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245138, "uuid": "47c832aa-6952-4d1d-a976-3ced21ad379d", "comment": "Malware payload (ACRStealer)", "value": "88980bcea3addd53f4a55369b7eff4a274dc2987", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245138, "uuid": "0fd8a18b-2da2-49ac-802c-1e01248921fd", "comment": "Malware payload (ACRStealer)", "value": "00fef13a87f05eae17fd53173bc21d48d7ecf3b1d65f70b84c5991ae2ed2368752e9c122f45c394510a160db2cd8a238", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245138, "uuid": "a6058411-7450-4a5a-a08d-5e81af5a2150", "value": "T19215C0CE94959491E4D8B27919327F1AD23DFCC92DF0A6CF236B7124A33CAC1152E768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245138, "uuid": "0392e058-e0a6-4c5d-874a-3d6a6c4df82e", "value": "24576:4VF1hYzvZ8DG4IEP8A3a6S+PW41uAyLfCuiBYtaw:ihsOGJQp3ahR4wAeCuZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245138, "uuid": "7b032941-4d55-428f-956c-5b8d2fd08a22", "value": 950576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245138, "uuid": "356426b7-bf1d-427d-a3d7-243eddac0332", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245138, "uuid": "32451a5e-83a3-4fe8-ad49-77ace0644a54", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7d1c8f-7833-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783229664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229664, "uuid": "62cfd5b4-086a-4b7c-be7e-20a4d0d98893", "comment": "Malware payload", "value": "121b7835cc42bf790c59b436ceb68b48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229664, "uuid": "a13be619-a58e-45a7-97bd-eb90fcf95f8d", "comment": "Malware payload", "value": "43cdf113f48a9a3f12c54b31e484e6ecd67c4c65382bd753d5f08cceadc1b3d7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229664, "uuid": "89d5dabc-2a67-4938-9439-e0b9f4b521ec", "comment": "Malware payload", "value": "31b77248f4d8b9858830a736821d6eb6aa0bb34c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229664, "uuid": "425f3d27-bfdc-48db-b72d-b1e3f5eeb912", "comment": "Malware payload", "value": "9f929d048e814c4a896140ad83ace987a1fa1560a9b2f3a99ee2da58f38be7de3e053d2c7b3e2c5615c990ac253bbbe4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229664, "uuid": "737695d4-b75c-4819-88f4-034c192f47d5", "value": "T12DD6334ABE907430DD4390BE7C45EEC815F2898AE99C3BAB7D0E1955FB2C288CD93535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229664, "uuid": "8d2ad00e-c56c-4ea9-ac0c-3e0bdfeaa63f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229664, "uuid": "309e6ff7-005f-4359-b4a4-866eb5d9a2dd", "value": "196608:jqt/Seet+c7RsLFHdbm9UpuRaTde8Jy8skx4j05LskmDSX7T6As2SaK2M3Z0pI+X:jq1S97RW969+DBe7t4skmG/7SdVf+Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783229664, "uuid": "1a449d60-ad13-432e-ba1c-f2410f1c50ab", "value": 13058200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783229664, "uuid": "a1337c18-e8be-461b-bbaa-048f11910976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229664, "uuid": "5761697d-a4a8-4500-b4af-25e31fe9471a", "value": "sample-43cdf113f48a9a3f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715af656-78a3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783277880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277880, "uuid": "e4c43aa6-5909-4b14-bd1d-718675dbc13f", "comment": "Malware payload", "value": "595eb28f84979f035375a35efe92c259", "object_relation": "md5", "Tag": [ { "name": "i-odsports-com", "colour": "#459653", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277880, "uuid": "534a5d6f-35bb-4fa1-b543-6e20a306c003", "comment": "Malware payload", "value": "45415f110b7961eea726dd3b1c07ebed2bbc44d13e8d92d0d8bd1304ba145d73", "object_relation": "sha256", "Tag": [ { "name": "i-odsports-com", "colour": "#459653", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277880, "uuid": "17c69c66-f37e-4baa-b77e-02990951058f", "comment": "Malware payload", "value": "cc7b8f647406840c119aca58278b120534e8194e", "object_relation": "sha1", "Tag": [ { "name": "i-odsports-com", "colour": "#459653", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277880, "uuid": "bfbf83c8-10b2-45ca-81e3-711d7fe84de1", "comment": "Malware payload", "value": "e73d66c2147cd84a37aedb30ca7faf81b1e340c15ebdcba65c5cd2dd64454463036cc8d639ea8dd052409c05d27e5b0a", "object_relation": "sha3-384", "Tag": [ { "name": "i-odsports-com", "colour": "#459653", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277880, "uuid": "ab1c3479-9e96-4a3f-bb71-ec813e71d258", "value": "T1E055AE57BE9104A5D4660E71C5B3B364AE36BC0433A0889A1379F13CCEFB6D0A57A7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277880, "uuid": "06eddcf7-f1cc-4c4c-a742-415b49eaab40", "value": "24576:PET2+6lAvtemMo+yW5WIDg9coGOdz0iXN:Pw2BKbM8W5W9p77d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277880, "uuid": "3363d3aa-19ec-4d7f-96da-047f91d7fee8", "value": 1388544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277880, "uuid": "344914bc-4e39-4251-8d88-159e42b699eb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277880, "uuid": "4e091aec-55ef-4f99-ab3d-4994e3278fac", "value": "Installer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c15d28-780b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783212745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212745, "uuid": "f27da4c2-5d11-4079-87e5-6064cca986a6", "comment": "Malware payload (Efimer)", "value": "43e647b9d685e1e5be276026df86d7e4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212745, "uuid": "4f56207d-0fe6-4e4e-90f8-08e172087ee9", "comment": "Malware payload (Efimer)", "value": "46880af4b7bbb74def06569aecda2d96702de4b8b7723b05af927674928ce327", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212745, "uuid": "fe16e7ec-523b-45bf-8db9-0bbb232a8396", "comment": "Malware payload (Efimer)", "value": "3acbcfe403d42d59ce337403a39201cad1107ad4", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212745, "uuid": "c174d10a-f622-4ff2-9b4e-00c75c5d0017", "comment": "Malware payload (Efimer)", "value": "e631b45e685fae733c81b10dbdd79916704e1291ca99819b1d30929d1f226d13db645fe48be66a106b3126ad5cce6b29", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212745, "uuid": "b159e92c-3808-46b1-a0a5-9909002469c3", "value": "T1FDE6332CEBE006FFD6730035EA66A199E56578221BB1C58F279897C66D833E08C3D753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212745, "uuid": "eb5ea3a3-7aea-45c3-8763-c783763200b3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212745, "uuid": "0a544945-c6ed-43d8-b2dd-3f6cf0970034", "value": "393216:ybO0JfWO7BcqDFCa3ETsCuIxH3XMCHWUjXMcuI3/PGTAI:ybJetqDFCF3RXMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783212745, "uuid": "f6addfc2-cc94-4716-ad8a-4ffdb5e198e3", "value": 14315718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783212745, "uuid": "6f106266-fb18-45fe-8ace-d1f47675afe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212745, "uuid": "ab88d7ac-d58f-4312-8621-08caa38d130d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e27b72d-7866-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783251702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251702, "uuid": "c41b9a2b-6bcb-46a4-aa8e-43f3a182fb01", "comment": "Malware payload (Vidar)", "value": "4de734c2a865966c5c77569ea7377852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251702, "uuid": "df740ea2-4da6-457e-9e4a-171275f0b440", "comment": "Malware payload (Vidar)", "value": "4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251702, "uuid": "a6080cdd-1cd9-446e-9c9c-6b4513571c4c", "comment": "Malware payload (Vidar)", "value": "3c8b5cb8e6031bbc5a0ce5c6991b9fcab3133a5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251702, "uuid": "54e8e8bc-1b72-4cd7-9f4f-fe85b4c461df", "comment": "Malware payload (Vidar)", "value": "f583b516b6ef250840a313b6d17ab0fee5e946c81b6ffd5c1c0af58ce2957da01b7364bdd44b1ccc66461c392b4d5897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251702, "uuid": "2cbab47e-91a3-4510-b217-c544aaddb3e0", "value": "T1A3C36D5A7752E0B2E48D2375523E377DCEB09F353CA0CAAFDF803D0A9E29190525616B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251702, "uuid": "dfd3e99a-fe49-4d19-82ce-1c1a2e712797", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251702, "uuid": "d6d458d9-381a-442f-94cb-f8d6f04866dd", "value": "3072:6EFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXBB:J3h0aMJ+Hw3Pgen79/GvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783251702, "uuid": "2ca95e3e-6ebf-4cf5-9896-f36ee616ec61", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783251702, "uuid": "22fe559f-e76f-4c16-ad17-7ef127316605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251702, "uuid": "6b2ce170-4cbc-431e-a456-7c9dbe651941", "value": "4ae932c3a530a58fbdaa8fe29fbf8ab9472ab8fcf3026b61446a5fad689120ae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9dfb22-789a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783273931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783273931, "uuid": "cb8fbb65-23e2-491d-bb1b-504de7c09ba1", "comment": "Malware payload", "value": "bc7725beba4203506dbd644dc3a049c9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783273931, "uuid": "7a87835f-df38-4aef-9e21-fb73f628916e", "comment": "Malware payload", "value": "4c1e7019090e7e9c42dc1efe990ea7ae94563a3f35a2745c6142be8ca981df6a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783273931, "uuid": "51905cef-700d-40d4-9e74-b46f6c14156a", "comment": "Malware payload", "value": "397d75cbd7563fc8807351588cff1c5aebbf49d0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783273931, "uuid": "6d3aedaf-ca43-45aa-a054-60fcfd92b438", "comment": "Malware payload", "value": "b7783acfe939ab08019d1db5ea60c8ed67ed2f4f42799342e3d981ca411f03ddcffc3c644efdf3ca470773ce97e8560f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783273931, "uuid": "11972f35-05fe-4dda-a9b4-bc1cddcf15da", "value": "T197E63354A4E403EAE5B3007DECE25194D6A474B28BBBC6DF5B688775FE931C0083AB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783273931, "uuid": "12305220-4c95-4b3a-b842-b7ce7c5e9d70", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783273931, "uuid": "1aec6c61-977d-4aff-889d-2e333ce7b6e5", "value": "393216:SmATml7dvqbLYorR4d4XMCHWUjXCcuI3/PGTAI:xqWvi4eXMb8X/H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783273931, "uuid": "cf4ee758-d16e-4319-89fd-86b6eca1b7cc", "value": 14282788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783273931, "uuid": "4a9ee71c-8d9b-41c0-831c-97efd1fc15cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783273931, "uuid": "0ae01522-11a3-42d3-adc8-de87ca5ea98d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb56d6c-7888-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783266489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266489, "uuid": "db67b7df-c79a-4f9c-b467-f4abd2842fbf", "comment": "Malware payload", "value": "4852d0c7256d019e3a1fdc87cd340785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266489, "uuid": "72338eac-a9c6-4e7a-a727-1ec93d90c29b", "comment": "Malware payload", "value": "4c666890a558a284ac2f14950f096f255f622b9b4e32771d17f4667d63d2847d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266489, "uuid": "e97108b5-b6ef-4941-9d4b-eeae84666489", "comment": "Malware payload", "value": "8ce3cac77dd5d77e9168d8486b46e5aff74c89a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266489, "uuid": "2dcde684-f5cc-4c30-b45c-06bb2b774101", "comment": "Malware payload", "value": "8c310fd044962014ac3d814862bd376b38539c365e03750dc69b115e6df43be895e3e3e62467b8c00bd16814cdcaaf60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266489, "uuid": "9e033823-8781-4cc7-a141-693f7316416e", "value": "T1CDE33C17BAA530FAE27BC978C5520A01EB72BC755760AEDF03504EB61E136D48E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266489, "uuid": "4f69ec4c-98f7-4199-a8a8-22666fe2e4d5", "value": "45f7d074cfde0aea03d8fb146af0198a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266489, "uuid": "49f91ae0-c4d9-4a43-b417-86519c505a84", "value": "3072:6+NIj6vDqbhyeRgUNp3d2DIT32W0jtK3w0zzmlZOfjYx3:nfWgUNptMYGb853MOcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783266489, "uuid": "27873518-7191-4ae6-80e3-2ca0d85f4b41", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783266489, "uuid": "42dcc7f4-988e-492b-b273-3a3bf8828171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266489, "uuid": "1ad0b6b6-42c1-4d0b-80bb-0766d8029e75", "value": "KMSActivator_version_1.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d6ac719-783a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783232615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783232615, "uuid": "8c24ec95-1b20-4a09-9066-fc33c0cde0bc", "comment": "Malware payload", "value": "bcc44ecaa70275f10a1e5d239767f3f8", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Wasp Stealer", "colour": "#982534", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783232615, "uuid": "b6e965fc-42cf-474f-b6bf-35435d204fab", "comment": "Malware payload", "value": "4d74a2df37d961af81255fc64ef1e49a5805bb1eec98513fbb93295fb8c482f2", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Wasp Stealer", "colour": "#982534", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783232615, "uuid": "c19e2311-25ce-4784-9032-57ea1b988c1e", "comment": "Malware payload", "value": "64195d7f824110c82521fd6103ebaea616e89b54", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Wasp Stealer", "colour": "#982534", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783232615, "uuid": "f9398a47-99fa-4bf7-86d0-ecc159d7c4d7", "comment": "Malware payload", "value": "120260b799969528fbf2d8ab7a6f60c029e16b3c974ec3c3966dc78cd8d3b53e8f01ec6f2d8694f9184ea65d9bf51a31", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Wasp Stealer", "colour": "#982534", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783232615, "uuid": "27da4a2b-c726-4f57-8b92-eae98a153a14", "value": "T10A083390E0FB34BDF41BDB761142CB95AA7C0E049706ADA34197BF67488A67B050DBCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783232615, "uuid": "89edf0f5-baba-491a-b0b2-e7c86039027b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783232615, "uuid": "90914ba8-7dc3-43e8-be5d-931be9ca2d1e", "value": "1572864:6/WHHr90/uSk+8sNjnFcDcy8DVqBWm/wx7BLbiTkcE3tZc7:6/8L9EuSk+Z5qB5wx7B99Zc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783232615, "uuid": "1be9e46b-dfe9-4ff2-9832-b81845c2f586", "value": 83325256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783232615, "uuid": "3b140986-fabe-4eff-b698-f0204800826d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783232615, "uuid": "524b981b-f270-4525-b761-88d68a306a8f", "value": "RunningGhost_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1c1cea-78a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783278163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278163, "uuid": "92819e8a-4ce8-4248-9a6a-7aa04f94095b", "comment": "Malware payload (Mirai)", "value": "35aef9869bcc180c21f1b48f13cdf6c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278163, "uuid": "46a6843f-71b7-46a4-8c6e-bcfc988ea9e0", "comment": "Malware payload (Mirai)", "value": "4e9cccc55530a83f6377e0d8fe971c4cca348b78f2479a1a9b0a93a44a1490c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278163, "uuid": "b75ec086-62b8-4a38-81d8-354b13698b5a", "comment": "Malware payload (Mirai)", "value": "01491fa3581a55a4d0745478d64b97092f6586bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278163, "uuid": "a177b098-0ada-49d1-8d0d-433c4a557688", "comment": "Malware payload (Mirai)", "value": "3a9454778743751726a5ed78a24a756b9d3a71492fa12c80b2d577c7615a8cd78801923ec72048471c92be7314433491", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278163, "uuid": "5618a1d0-a297-4753-98a9-915a11dcbc70", "value": "T107A38C86FAC3C1F4E98344300167FBEB8B35DE368065DB4AEF543971ACA1AC5894636D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278163, "uuid": "a47d1913-f6ca-4d2a-9e2f-25d5f442fac5", "value": "3072:sZerKKDh1g4g/jg/YX++1L7f7d9a2BxwM:ScKQ68wdL7JNjwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278163, "uuid": "2a65876f-a863-4070-8c4e-5bc3f850c95b", "value": 103792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278163, "uuid": "6dd2f3dc-7110-4e81-bc6d-a9fb55beb10d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278163, "uuid": "1de3449e-96cf-4665-864a-4b655d457a8a", "value": "ohshit.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8ad688-7852-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783243086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243086, "uuid": "17ff2c7a-bb2f-4cf6-9c96-4d18b51785e6", "comment": "Malware payload", "value": "b732d61d3e2e9fde5c8b971ab0e33727", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kryptik_", "colour": "#48060C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243086, "uuid": "d6540a68-f184-406d-9f4b-39ca592028a6", "comment": "Malware payload", "value": "5139c6c7a6dbbca9e0dc82fa8adbe048cdfc48db599f21bc8dc136576a0b08f5", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kryptik_", "colour": "#48060C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243086, "uuid": "fa2bb8fa-c297-4a6c-9aa1-e73d54443048", "comment": "Malware payload", "value": "ff0a6d72c1d72afd3fd6c6cc4dc5b2c5454da02a", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kryptik_", "colour": "#48060C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243086, "uuid": "9bd43062-341f-40b0-8731-49e7e877eb71", "comment": "Malware payload", "value": "5a5c2a4978386908b6d4f4822fdcd0c50dbb07d65693d3788e0b16bad856dc168f1ad79f8d40e89d3eb7cd55d4398dc6", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Kryptik_", "colour": "#48060C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243086, "uuid": "32d59670-9220-4426-b6e4-a416cb6ce154", "value": "T1A476AE06F4558DBAEA339679C42184C23BE1BE272F2202DB315CB7E529B27D1417EF58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243086, "uuid": "4ecffee5-a7c5-4f7b-a556-bc4a53081c62", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243086, "uuid": "8c5028d9-16de-48f1-b968-78884aba05fd", "value": "49152:lQsTxbHSYL6se4yh38uacUvu6k3SMMr51p:la4yV8ZuJMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243086, "uuid": "781562b1-d2f5-498f-932d-beb2df88e78d", "value": 7769264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243086, "uuid": "c268ac60-94a3-4afd-a78a-32115e1dfba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243086, "uuid": "0ba82571-02b6-4bd6-9209-eaa807ee6bff", "value": "curl_ext.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a8c573-78c4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783291931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291931, "uuid": "802cfabc-edfb-4414-88d6-7fadd0f1c2a4", "comment": "Malware payload", "value": "1dce48c9b52aecd3f5bab8714c8f2614", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291931, "uuid": "23b03d70-b2d7-4d75-b90c-71a8db6cf163", "comment": "Malware payload", "value": "53de9fbfc8ec10fe8b317143126afd2b91b9cff9ca46426581d2d7653a12438f", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291931, "uuid": "44fb16d2-a06b-40cc-85b5-34780d0db155", "comment": "Malware payload", "value": "7cb7844cdc055346c71c14ddb34783d81fe097aa", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783291931, "uuid": "0204508d-aac2-4b85-b778-feeff4a74ded", "comment": "Malware payload", "value": "d2823633e0aed97c156a71e3d62b5f7b9b89c6ae8d6458d49e842055f1da33131c740fc44a0ec46b8211416870461607", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291931, "uuid": "309e5c40-e102-4ebd-9fab-5dd046cc7192", "value": "T1EBE633482AC111FFE973903EFAD05590E6A970B80772CAAB43A8CBA16D1B3D14D3D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291931, "uuid": "b966bdff-727f-4166-ac2a-d5cc5d5e2b08", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291931, "uuid": "51c52368-a561-4c88-811d-3eaac9ca69f0", "value": "393216:dq4+7Yh5ON3gpe/2DmXMCHWUjXicuI3/PGTAI:dh+7YhEx+DmXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783291931, "uuid": "4c0f4d6c-07cf-4d3a-98d7-941f3f3e0be1", "value": 14255929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783291931, "uuid": "24c1e9be-e633-497a-a5c1-578cc0cbbff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783291931, "uuid": "7c53ef8e-5f7a-46bc-b33e-45f17746b542", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b57cc5e-7886-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783265361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265361, "uuid": "26efd3d6-aeba-4123-8e30-fa790ee7252e", "comment": "Malware payload", "value": "f2887cdeceba02c3518357f3f3fb1545", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265361, "uuid": "8697a2e0-1202-45bd-9c01-7ab844d0f443", "comment": "Malware payload", "value": "54a4c6f8c7fb5775caba77370549688598ea028b9974ccc19a4cc4052fbb895c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265361, "uuid": "c9924141-e64b-4160-ad7e-1dd7451e2992", "comment": "Malware payload", "value": "63788feae40cbd17b450c8b54dbcd8f78cb38f38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265361, "uuid": "de81a199-75ef-433f-96cd-f26d35b8647b", "comment": "Malware payload", "value": "d18d67b44e43322c1e53ef1add1e1297214dd97ac94ea61945ac80ab65245ddf4187a0698eeede84b3e84e363600b991", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265361, "uuid": "9fbd84a9-7be6-457f-885b-68f70c223900", "value": "T1C6663319ED25063CEA7839F725062FD0C7DBBCA6093393691992AF91DFD35B04631EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265361, "uuid": "684e6511-da25-4343-bda2-d629504518ea", "value": "196608:NL3fBgR75ute+r2f/t8bwwjA9jzuN1siTaiI:DgR75y1iKMO1siTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783265361, "uuid": "507e9088-7133-4db5-a858-b875ca17cf85", "value": 6541779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783265361, "uuid": "5d1b3be3-4ff5-4175-87b2-ea7ae6208d14", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265361, "uuid": "1dd15196-fd7d-4bf3-bc74-6a8869744cb4", "value": "minern.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4467a75-7826-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783224305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783224305, "uuid": "58c1c36e-18a6-4867-91fa-2c179d80f629", "comment": "Malware payload (NanoCore)", "value": "2e3bb978d68490c99faac7f590933832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783224305, "uuid": "e078c079-3440-47d7-b483-430cc94c1d49", "comment": "Malware payload (NanoCore)", "value": "551aa018350fcf2b435b4d361dd4f117349a5136851f84ac10c02da1526e4e67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783224305, "uuid": "1f707dd4-b05b-4d4d-804a-608c73c3fb7a", "comment": "Malware payload (NanoCore)", "value": "c9970f57910e5e2bb746d838ab0f248bdfa1e15b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783224305, "uuid": "9b9b544c-dab6-4b54-80bf-be86bf78b817", "comment": "Malware payload (NanoCore)", "value": "e52530c2813f2e728c999d3afe7384591889ced31b3fb0704a8b149f8a543d8f7648110cff58e4e57b00ae664cbfe6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783224305, "uuid": "45ab6372-2ed3-496c-a708-4f765554cdd1", "value": "T14414CF2A77A84A2FE2DE85B9611211538378C2E3DCC3F3EE18D855B35B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783224305, "uuid": "428e6cad-5a32-49cc-84bd-50db99db9e04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783224305, "uuid": "b04531f7-e1ab-4f50-9ea3-fb84f1e012c8", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI2asvu1SEImfAF8V7m8CJvflRa:MLV6Bta6dtJmakIM5JuvImfVqflRj0vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783224305, "uuid": "d29234e3-0ef5-41fc-95c1-d2e7844eee06", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783224305, "uuid": "de96de10-db6a-46bd-9e59-e789f50e5ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783224305, "uuid": "0c21825e-faf9-4391-9ecf-16efbe85ab04", "value": "sales-tracker.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835a7e04-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209620, "uuid": "d0090d37-2ed5-4a6f-923f-62f9d2c07ea8", "comment": "Malware payload (Vidar)", "value": "d9a904c03fe2967cbb32211c28ef2da6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209620, "uuid": "d30ace87-0359-42dc-87e7-aae614219dbc", "comment": "Malware payload (Vidar)", "value": "5525784bfcc0c3340da0289ab8a5aed5565e73dc7246366b246ff000f7757ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209620, "uuid": "eaa83e28-bd00-4e6a-9fbd-f1a7d2cc42d1", "comment": "Malware payload (Vidar)", "value": "8ec145ca3051276ef9698916841d785067ecfccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209620, "uuid": "bef22ebd-20b9-46c6-929e-9109d4a2631c", "comment": "Malware payload (Vidar)", "value": "e6f3e3044ddd993dbceb600d6cb3bda791b99c961299e293ff96ff9f5c65b7b2ddac2681e6a50fc120d33657624f3fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209620, "uuid": "529aa950-da1d-4316-bf1f-ed81aae720e3", "value": "T101D5AD0BACE209E9D49AA7759DB342567B38FC494F3227D76E8076782E723E18C35740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209620, "uuid": "c59bb09f-7dd0-4d85-871f-8badfe4b7b26", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209620, "uuid": "838f8ada-92cb-4479-bb6d-5fb7a72d0d71", "value": "49152:csEmnyDjTfZ+tR78mDAa+Rr6wThpfLgKBZOtgO:cs5fj8L0UAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209620, "uuid": "aec6bacf-5752-46c5-8045-fc6e388fc38d", "value": 3004800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209620, "uuid": "e3d4603c-32bd-4caa-8800-f4408ba8acf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209620, "uuid": "e1931e3d-630a-42f3-a648-d3a140b3975a", "value": "SecuriteInfo.com.Win64.Evo-gen.49523153", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0a811c-7856-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783244930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244930, "uuid": "609f6a09-ec03-4c6a-bada-b6dce1546dff", "comment": "Malware payload (Mirai)", "value": "c534ac1b48c0a6ad5a5dbac1ed7d02d8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244930, "uuid": "2f583f58-deb2-427a-9603-abe65dad3421", "comment": "Malware payload (Mirai)", "value": "55afdea1211bae14bba08a814fcb659c64df7f72369440852c86285c90067dd5", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244930, "uuid": "274e3e6d-2fb2-43f9-88ec-cfcbeed7b082", "comment": "Malware payload (Mirai)", "value": "c4b6833f3a8f5abae5b36a1858142874065dd3b4", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244930, "uuid": "ecceb3b7-0901-4198-81e6-b03b970203a1", "comment": "Malware payload (Mirai)", "value": "2dbef60221c6f7a118fb3cead93f5be6c7aa69581187b7bc98973b8c5dad7a5af44d8a79e739e2578811345c73e1b099", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244930, "uuid": "c8b59e08-e555-435d-ade9-934415a3b545", "value": "T10DD2861FE2A0CE38E4C5F3318A9F82219270B4F4BB31615F6A4195F73D963498A79E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244930, "uuid": "63f582c1-9f1e-4f25-8efe-9a37cff537fc", "value": "768:1yFKQog4wIAYQog4wIAYQog4wIAYQog4wIALjbzrD7TLjbzrD7TLycForu/9XHW:1UD/lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783244930, "uuid": "eb63bab4-6ee1-40b2-bcff-4c471fda9cea", "value": 30744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783244930, "uuid": "18d5df3e-b40b-4871-8b50-a3d15b9b0cb3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244930, "uuid": "6a55095b-148f-4529-b2fd-454d934f6cf7", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4796b926-7882-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263636, "uuid": "c34003d3-9b5a-4ec4-a58c-3077325e7d58", "comment": "Malware payload", "value": "999fb07f6bba6b372663ccca1fe1ee1b", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263636, "uuid": "2ea95d57-53b7-40ff-a623-c7c014162a00", "comment": "Malware payload", "value": "588d7e4a3d75b522b15fc38d5ff517813c7fba2caa2f8f19fd93edd6136a3c95", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263636, "uuid": "d53d3725-0f0e-4a17-a818-b22fc6832718", "comment": "Malware payload", "value": "44c02f3dca412a2185a5735fdc6bb8a9d5a1afa4", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263636, "uuid": "59ac7a35-3e11-44bb-a297-28fc996e8770", "comment": "Malware payload", "value": "468ba1d020333131262022bc4a190fdf63f670b1087c525c74b177a7bf0eeccb189655b7db9f273be6d1a5bce72e2a9f", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263636, "uuid": "3252c18b-d573-4d7a-8da8-28a65cdb238e", "value": "T1E587C01DE74CE83BDDC6B4FC8C4509A263277C845720D3962913B50DEEB37E44A69BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263636, "uuid": "bd83f634-9e98-48b2-b100-a50e58ef0102", "value": "786432:UMfxZYDquBDyDUSJ58Jdtlgpp19eHSyg1jy80Z8nipsA59O:UeYDZocpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263636, "uuid": "d7a8529a-b573-447d-b34d-b82a894b9de9", "value": 39011790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263636, "uuid": "623d2251-504c-4ebb-8f14-0c145d267f99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263636, "uuid": "80ceae3b-4529-4032-a0b6-02fd950e3cf5", "value": "Quick+PDF+Scanner_1.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f681662c-789c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783275097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275097, "uuid": "b7c39f77-a4a1-4d02-8ea6-9f904fee8e35", "comment": "Malware payload", "value": "bc9acf040fd126bd2d79f6060608bf4f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275097, "uuid": "de1e03af-52ce-4c4b-b5c2-9d201b5cf624", "comment": "Malware payload", "value": "5a11b2391438d4329e97f997db4ede05571c0d392167c76fa2e76e4059b02a19", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275097, "uuid": "e9d6ef86-105e-4080-b207-2ede1e3c5c26", "comment": "Malware payload", "value": "0fe5527cacbd1f5137748a2c68d2a6cd5bfe56d9", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275097, "uuid": "15ec1ae5-8d34-4a30-8a3c-660847e40400", "comment": "Malware payload", "value": "8fe74dc60cc7416956e1795be55e2ecd9a8a903100feb7192d1d484417873e4625cbb83ddf3bf68cb9b22d1f3cf53a72", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275097, "uuid": "5dd5a035-fc12-445c-b151-3b6748a82185", "value": "T1BEE4238F31AA0A4DDC37B3FEE9958A86745E93E0D1068C2D0C6576D28451AFE0F0E75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275097, "uuid": "4ee5d29d-957c-4989-9e5a-e87473225c9f", "value": "12288:dWylW9pUO4tV8ZLNhyMHFdRy1qHvY66nH7Zg4bhbeJpia8gDypmd:d2o+ZLNIKyZHlgabeJygDy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783275097, "uuid": "85f17728-943f-46e9-a864-5386215c3f5b", "value": 674001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783275097, "uuid": "b67a2de3-5602-4daa-af34-83f9232ab39f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275097, "uuid": "fc4ba226-3b64-4751-9ade-4f86b987b907", "value": "chickennw-dupeV2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a258246-78a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783279961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279961, "uuid": "77760df8-8954-4309-859a-39fb61771e55", "comment": "Malware payload (Mirai)", "value": "b24b286eb4d169e653ca9bc60fb98cdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279961, "uuid": "954ccecf-e08a-4a14-b279-e62dfb68e36a", "comment": "Malware payload (Mirai)", "value": "5a77a8978f2c50071abf35abe267c317fdf364b14398bca2f85b3c8bfc52064e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279961, "uuid": "f8abe370-42b5-402d-81ca-039ade941a2d", "comment": "Malware payload (Mirai)", "value": "2022d17d30319225574bc7f2a440cc73b7875394", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279961, "uuid": "8f3a328d-fdff-4da2-830f-b2eba71be77f", "comment": "Malware payload (Mirai)", "value": "489d22f65c5710962fd134f4ecec28820f17b460c91d6df5d0f3bc4f2c61b5d5681f39a731580377c7364f9b97082fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279961, "uuid": "ac91723f-1fbb-4e7e-9d1f-f6adf0cf4602", "value": "T19AA32902B58150FCC4AAC17887BFB527F632B86D5234BBAF1784BE312E32EA15706745", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279961, "uuid": "5e859d28-676d-4fb6-9c2f-4a0508bfd791", "value": "1536:3HSjMqbErpAmjN2n4vsZv+EVHcBFhhzaqh+WXnWTGsEk5G1T+yq/0WTTn2Jfhor:wEd2n0AvRVHiFHzaqnA1SpWTb2Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783279961, "uuid": "69be5ab9-d165-41b6-8b62-c115a0dc508a", "value": 104592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783279961, "uuid": "644aa470-2717-4657-80ae-bd98a3baa026", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279961, "uuid": "7e8a4ec4-0a69-4546-bb27-70b236f9d76f", "value": "ohshit.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e090700-7882-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263728, "uuid": "69e0fc2a-e1a2-4668-8ed7-ec3661bb182a", "comment": "Malware payload", "value": "58b1a900dfdf97e01012fcef70a6ed46", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263728, "uuid": "5adfec13-86e0-4df6-a899-604f9bb1e099", "comment": "Malware payload", "value": "5a9fbaad3aa19d34cecb672136c9d62ec0789648ec923db6001a5412ffb28ca7", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263728, "uuid": "eca55a6b-7fe6-4c09-b84e-0d6fb3f55402", "comment": "Malware payload", "value": "ee802110baf4af10405864f1e0ccfb73e60af5c1", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263728, "uuid": "c818702c-80a6-49db-97be-8b2e4a96ac27", "comment": "Malware payload", "value": "6e5ab92e06e5fac276713505db4576c1f0696a904ce82f18eff528a5888ec9cb9a5824a4880564f4d3bbc79548aa6e8a", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263728, "uuid": "e98b80fe-707f-4224-bb2e-380e99d4120b", "value": "T1C457120EEF0DF82BCDFBB478CEAA4212722664995241C3776511D128FE936D94F16BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263728, "uuid": "3cc36cb6-d8b9-4533-9687-6b89914389f4", "value": "393216:NHcugwNSgzBH5hozpRkDMGHZbM051KXhg9kBhuLyt8FCzNZ+5LzcCRl9L:JcDqRYtRkDMGHZb32XhBau+o3CcCT9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263728, "uuid": "e1464305-308d-4d2b-a315-dec477ac8219", "value": 27210143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263728, "uuid": "ff7bb1fd-58ea-46f0-97f8-ddc7d4e38b8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263728, "uuid": "0b029fe6-af5d-4d24-8b4d-d497b565f3f0", "value": "com.malaria.livewaback_1.6.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca82eef2-7810-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783214893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214893, "uuid": "ef708289-2175-4614-8dc0-5884259fec8c", "comment": "Malware payload (Mirai)", "value": "9b5e9ea4ed0ba0fd94033b766b6eb1b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214893, "uuid": "add6a7b7-8e5f-42e5-85cc-edb1045069c3", "comment": "Malware payload (Mirai)", "value": "5c8dcfaf72d826e5e944b2b3c5a5f19c52f5d254e4f7de5a0a385354e778e955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214893, "uuid": "99d42bdf-b3af-4811-85ff-f8570d70e357", "comment": "Malware payload (Mirai)", "value": "68d325d7b2c6b63cba75ce6113c32890b007ca26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214893, "uuid": "87ebf705-691f-4232-bf87-748dcdd21570", "comment": "Malware payload (Mirai)", "value": "d6054942b0b4aa3ed6555598c09809947ede1159556d88f113685720363e2f0eeb4a15be30166b806366e3871762d5e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214893, "uuid": "09133da2-9c1c-4af8-86b3-7ecec7ac01de", "value": "T1BC144AC3F900DDBEF80AE73784134915B130B7A214925B37B257797BAC3A19A1467F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214893, "uuid": "3ee55b32-4b45-4643-83d9-31ce96652922", "value": "3072:29/k/QZzZKBITD6KATgmgM91XAD6MYmTQ1ci1wVejbiUL/4RzyqC0niS:mM/QZOICHgM91QDXlNi1jL/gyqcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783214893, "uuid": "f8179ae7-fb16-41ee-9b76-1ef4882a8114", "value": 191712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783214893, "uuid": "89126c31-a42a-452c-947f-db8cb8daba45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214893, "uuid": "812310ae-05cc-4632-bd96-a6f6380dad46", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5a8b21-7886-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783265600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265600, "uuid": "7110d1d5-8946-4ee1-b54f-b013818483fd", "comment": "Malware payload", "value": "95047313493d175e4de3179a2640bc4a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-osqOJYyCNqUGETCb", "colour": "#77AD01", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265600, "uuid": "b7b6907a-2c98-4d95-8a68-cb32f22e453d", "comment": "Malware payload", "value": "5da0a571769ac09aed3a4562fabe86b03b6b2a87190dcb0501e33734f984715b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-osqOJYyCNqUGETCb", "colour": "#77AD01", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265600, "uuid": "b00c5b90-3bd3-4ac1-ba3c-d050317ca0b7", "comment": "Malware payload", "value": "99a1762e2fa47bea4038b363e8d04b9036b64a49", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-osqOJYyCNqUGETCb", "colour": "#77AD01", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265600, "uuid": "ca9ed07c-402b-433e-baaf-7a91bc03e613", "comment": "Malware payload", "value": "4ee8e1ff1df57e93142cd2e232ab234d0a6c195224d37aeb9005172e4ca116db8e8320f8bd42e90a26dc8d732c11cfa4", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-osqOJYyCNqUGETCb", "colour": "#77AD01", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265600, "uuid": "e4209c82-59be-4981-bc6f-ffad4e1d6bd7", "value": "T1EEA5334977560DE4CBD4E5AC3AF90F0F10CA2893275A11EF41A5E29D9F6C63BA0DA70C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265600, "uuid": "04092095-163f-47dd-916c-0cfd7ba0039f", "value": "49152:dRUAWUkrylvPcyLjkghRHRkNJLjnaWmdaCo:dRUrrylXvPl2NBmICo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783265600, "uuid": "af4177bd-69d4-42e9-b719-c5008c8a06ca", "value": 2229683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783265600, "uuid": "f36d1864-c049-4ee8-9d50-9df91592c194", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265600, "uuid": "dff999a8-dc04-488c-8dad-ea0ab4b1e32d", "value": "2JokesBallon.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30166393-782e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783227519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227519, "uuid": "ba0fa9a4-cffa-4cb2-bbeb-718b65f62032", "comment": "Malware payload", "value": "42614b6e053d890c65f10b5e5adec61f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227519, "uuid": "12f6f54e-6b7c-476c-88d1-1704f9f9711a", "comment": "Malware payload", "value": "5e04e37bf2cdb841ab52f797a6e92ece2b9c298815341e7b57a8698c2e08309a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227519, "uuid": "394f6cbf-9924-4602-a6d5-536425ecb9a1", "comment": "Malware payload", "value": "088034fee4212203aae20611ef97f4b76fbca9d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783227519, "uuid": "9bd2abe0-2144-43c8-9384-b906fe1114c9", "comment": "Malware payload", "value": "2f5ff2ce3dfa19c2924747af81531d89df17f092870dd3ef3345fab617a317ae377743a59f00e5c2faaf70fee3c41d70", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227519, "uuid": "5f857f98-e246-44ba-bfd5-a6e3b5193457", "value": "T16A13E713B945C832E68153F12926AFB243FF9D316BE151D7B3C05E3A96216D52C32E2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227519, "uuid": "b9328262-81c5-4a4c-b947-72318bf2d88c", "value": "30215b1cc2c99028f7cbfd31b65fd1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227519, "uuid": "d414e4dc-51a6-4856-a8f8-c604ef411503", "value": "768:ru8jvODPYTAnSRUnCsPWrZp0te0rWA/Ch+KRi+ybE:3vOetRUDypMxLKAKR71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783227519, "uuid": "82798035-975b-4116-ab4d-745fac97772a", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783227519, "uuid": "b434c2a7-4553-4299-882e-a44f5d09dd41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783227519, "uuid": "bdc9f7c2-e0dd-4efb-9eb2-787f91f2ad93", "value": "sample-5e04e37bf2cdb841.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909f3415-7865-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783251303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251303, "uuid": "a0d11e1a-d374-43e8-b3d0-cbfe097b04fa", "comment": "Malware payload (Vidar)", "value": "ab391ae53d7ebc072521ec9aec4efc42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251303, "uuid": "bfb02762-b039-4097-831a-bbc0520676e9", "comment": "Malware payload (Vidar)", "value": "5f078709543c9f97fed54bdb60879c83ea00aa038cf25ab88a1a555a880b596e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251303, "uuid": "08370949-6792-4c32-b82e-9ab6b67fc4c8", "comment": "Malware payload (Vidar)", "value": "56f40e0bd2bcaeeaee7bd5f188a4ebfeeb92e3b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251303, "uuid": "dbbf9a4f-c704-4a53-91d0-517344e1c3d5", "comment": "Malware payload (Vidar)", "value": "9334a2181eef435b59da0ebb135d8d3d7347cbbd7f3b183d7d911a0750671ffc7b81933ae096c9a75fced1091936a11f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251303, "uuid": "0882be38-1bbc-4c94-b9d8-f4e9489876dc", "value": "T198C36C597793E0B2E48D2371523E377DCEB09E353C91CAAFDF803D0A9E29190525A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251303, "uuid": "ec86f4c6-1f7e-4395-9ba1-25d4c2c92990", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251303, "uuid": "61d16a90-838b-44bf-bd0d-e53244f9ec1e", "value": "3072:iEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTf+vXB:h3h0aMJ+Hw3Pgen79/GvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783251303, "uuid": "67920466-0330-4868-8423-7609424eb6e7", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783251303, "uuid": "cfc537e4-6058-46b3-86db-f362a5c037a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251303, "uuid": "280ccdf8-3d63-41fb-b169-cced590ac22a", "value": "5f078709543c9f97fed54bdb60879c83ea00aa038cf25ab88a1a555a880b596e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae44646d-788b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783267674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267674, "uuid": "c6c3a1c5-dfa0-4cc7-ad51-1857ea8d7f4c", "comment": "Malware payload", "value": "2a1439991b0e6719d47e19b2f4c40457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omani-disputes-com", "colour": "#85907A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267674, "uuid": "ed18d2a1-cd9f-4ff4-b520-6c232262e935", "comment": "Malware payload", "value": "5fcb9d72408d6781741db2da86b7d4675d607f469a731a9786fc96d59a1e9eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omani-disputes-com", "colour": "#85907A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267674, "uuid": "ad85ad51-9752-4aba-bdc5-2f0323f46333", "comment": "Malware payload", "value": "9e73d9275058d5aeaea3e36804ef929a345a1dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omani-disputes-com", "colour": "#85907A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267674, "uuid": "5e90bb57-4b62-45f9-b782-6bd95724d986", "comment": "Malware payload", "value": "587ab9d36aba30e476ec0ea015e9d147e3a522bd76bac1a8f8bdbef772fe742bf9e2d3a0bd15d1b67c4b57b72a61b4a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "omani-disputes-com", "colour": "#85907A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267674, "uuid": "2ffbf5a9-1d87-4b9a-b2f9-e04b2a945247", "value": "T1A854BF47373B5995CC3C7130A49E4A74A378CC2059438FC786DDB932E8B9AC6BE026D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267674, "uuid": "9274ad86-f7f5-4195-9319-baa0e9150b4d", "value": "6144:bRNOFzhSE6XraKFUL/QktjVeRIW4ygLYvGAjlEQHAshB:8gVRF6aLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783267674, "uuid": "b3a983b9-09be-4945-aa5b-93b75d8c1f10", "value": 300765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783267674, "uuid": "a411affc-7045-46e3-80bb-95a318a12200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267674, "uuid": "55df118a-de57-4de1-83e9-ba497e1734dd", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c566390-78ad-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783282005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282005, "uuid": "f149aa6c-c89f-4a49-85ae-e8f84020bf30", "comment": "Malware payload", "value": "052504d620d901b9c68dbf1d159f4e68", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282005, "uuid": "d87bcdcb-83e8-4f19-9c00-c0b061fe5a7d", "comment": "Malware payload", "value": "5ff40ae515caa482c04d44ac0078e3ea85917129d473b01b9ee9caf0c0cfbb4d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282005, "uuid": "504127d7-1868-4c24-a6a1-15b3e95f6c0b", "comment": "Malware payload", "value": "104aef9a41fbc6a3c4f257c52564cde723a7eba7", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282005, "uuid": "56968ae2-4cf1-49d6-8f62-a1a7c8d54411", "comment": "Malware payload", "value": "1a9104144ddb835f9c0ff9dd3afc20fc96d2ec261d76844f0434fd12d5e8ebd54736d5855954aa39fec9493e2d3b9af9", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282005, "uuid": "3bd5f011-0b3b-4035-af16-225299c1620c", "value": "T1EFC19412A3E88636DD724B31ECB713400A74F710DD5B9F2D78C5930B7D122588A63FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282005, "uuid": "a2d07762-d9cc-4882-85f0-670999935978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282005, "uuid": "649fbf3e-698e-4391-b1e7-c9ff6d5f29bd", "value": "48:646c9fLFXFnJzwPhi5DUs8LhIBo7hYIMhRBCBq3X9rl4B2qBHyJKiZ54tdt8Ulr6:FLFt65OD78FH7eBCyr+wkaKpOOzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783282005, "uuid": "c8b024d5-ab21-4bfc-91fa-c1d7b0e828ac", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783282005, "uuid": "f3c80fa3-88b9-4167-a06c-aba9ec472e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282005, "uuid": "6faf2fc1-6e07-4205-9a75-c0b16b712e46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0005df46-7859-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245907, "uuid": "7feb3ad4-5383-4a41-bb92-df01c3184649", "comment": "Malware payload", "value": "cfec77eb0496a5d28a14eb55ea14def5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245907, "uuid": "b8966299-b75a-4f00-8557-b6c252a0a806", "comment": "Malware payload", "value": "60b17488cbbda7313aa68d2eacfacde48dcad9e871efb8a771e71a49be20ba7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245907, "uuid": "8aa71f40-5e05-4989-88bf-9db3fbbe8789", "comment": "Malware payload", "value": "9ecdff2d8c34208c3a1a11d5d8a3fb4b9889b343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245907, "uuid": "f5d92aa8-e7b6-43f6-9563-f8ed2254ffc4", "comment": "Malware payload", "value": "f8ed4712f66ff82a823084a90997a12d9c1bf79b9628c7dc4ef0c8fa9073cb48f0ef11e7aee37ad4c4c543d82e5c14dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245907, "uuid": "4e9a5e29-daf9-4eb9-9c4b-27fa1b6081bc", "value": "T10886AF03E9541CBAE717D2B9A00E6067AF51B8A43B7502E7297CA3A55FF37D04878B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245907, "uuid": "92947d58-bd72-4b72-8f23-d90e861ce3bb", "value": "64601c5ec3ff479d2213b91a500dafdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245907, "uuid": "501cdde8-d2af-414e-b73d-fa31d8c2102d", "value": "49152:nq1zhE4HXMZWF7ApC/0B5WvuwUAOdL6UhW29s8K:nabVOdUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245907, "uuid": "41852cc0-f1f9-448c-9bd6-c76d019f2283", "value": 8407704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245907, "uuid": "ebb415ef-0172-4b16-9067-821d2a8ce084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245907, "uuid": "470c3ec1-71b3-40d3-91a7-7124e12d05d5", "value": "ecore-launch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0269bf4b-789d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783275117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275117, "uuid": "f7710ca3-13cb-4d03-bc2d-6b760c1bb514", "comment": "Malware payload", "value": "669a1cd4e6076599c89d61dea4b93156", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275117, "uuid": "24f51ae8-38ce-4ce9-8368-1d71ea0ea9e3", "comment": "Malware payload", "value": "61e7ab00aba70a210a4651083fea5aabacc5f6de1caddfbf72c9d83ae79f628b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275117, "uuid": "6b8633f7-59aa-4060-8cf9-7fb115c32284", "comment": "Malware payload", "value": "cb025caec4bac1e9a791a94d217e3c692e7a3256", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275117, "uuid": "574ba084-0524-41b0-997c-730517cd9567", "comment": "Malware payload", "value": "8ba88e619209c3b4b6d8e99b1d4093de0fbdc852707dda831685be03582adb8bfa6fdaf1cf67a7c0ff1810d3b303bab8", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275117, "uuid": "4f2b8bae-b89f-46c1-9f9b-46fa0468f101", "value": "T141A4233FAEFB5D57D54A077658889C80287C7063EA8589D2BA6CD1CC9173E020BC9BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275117, "uuid": "204f6b2d-a444-4992-a2d2-f51fd1b456d3", "value": "12288:m5dORYoanBmckLaSYyP2fDu3XNCOfFyHAA1ic7gMh:m5doaBm7mSLP27u39CNcc7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783275117, "uuid": "2e4de74a-c59e-46b1-83d8-99cf2c1b67f2", "value": 482281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783275117, "uuid": "b8163229-76a4-4b5b-be2b-6e52a1ab5def", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275117, "uuid": "97d56e90-0a79-4fd5-b626-9a217d0f3a6d", "value": "falsity-3.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f26e56a-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209613, "uuid": "d1bcde9e-2506-48b7-af5f-12a851bbe946", "comment": "Malware payload (Vidar)", "value": "776abc34a4ac6c2e3a93c809a39e1974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209613, "uuid": "393172ef-ddfe-4186-87c5-90fa755566e6", "comment": "Malware payload (Vidar)", "value": "62f16a144816655addc35fa23adb766203296c38b75452e6d30aa4a3a13df6b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209613, "uuid": "27c450bd-a2a1-4e98-bd16-361187db9f66", "comment": "Malware payload (Vidar)", "value": "2fa9cf5acea1246a6bf71fffcbc7b3d823f3d9e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209613, "uuid": "f751e103-9b82-48b1-9dd4-09f66a099c2e", "comment": "Malware payload (Vidar)", "value": "38fd2eb2fa5cef7a30e043a960c080d27277d0f85d7a1a178c649131d23e0e58be189d1598302e874d01556e52046e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209613, "uuid": "3446a099-a833-4ab7-b50f-bbc0f906cc56", "value": "T110D59D0B7CD048E9C86A6B3189B242967B34FC160F3623D72E5076792F727E09D7A785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209613, "uuid": "76158cb2-8ed5-4f53-a61f-322506d94803", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209613, "uuid": "05a23640-03c3-41e2-b945-f3a3aab62dab", "value": "24576:KUu5LYwzrN8FoP+kAytRHFoQbsZSRIEMUNTCB+Qoxcp98qScc2wHxcfAdrBRtxzl:KUuVY28YZAy3H2FU9iycf2BLgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209613, "uuid": "a3fe8c2e-9a3c-47e4-9256-54d5e2809620", "value": 2959232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209613, "uuid": "442109a6-f620-4a25-8e2d-466ae70d073b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209613, "uuid": "f75c2209-142c-408b-8cd3-148028637fc2", "value": "SecuriteInfo.com.Trojan.Siggen32.62131.22581.20107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01072c1b-7847-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783238178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238178, "uuid": "a561fa2e-494c-4c79-a3e6-ded9bb479f04", "comment": "Malware payload", "value": "0bafb14cd1fc0765557d5922b69ebea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238178, "uuid": "26f97816-e1f4-41c9-9e2d-89281e8c8fd5", "comment": "Malware payload", "value": "63a9df612e56b5ce7645393251e9adbf2291a4e959f743e3eb962a4b0f28904c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238178, "uuid": "af9b061a-8946-452b-a395-c236bdaa39b4", "comment": "Malware payload", "value": "e52475bb0d10ca0181763c6bc5929229f51ba262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238178, "uuid": "7b2f3f6b-4c8f-4e33-91b6-58f48d9c926a", "comment": "Malware payload", "value": "81094adf4fa3f1c5f3e95896ab6a6d36a36971a0701e0278eefb69aed873e460fc48610757ff867a79c852babcb0edbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238178, "uuid": "dfe3eb9b-8532-4949-8c2a-026bb3b1b663", "value": "T1A5940141B3C94ED7E0B30A38845E0B947539BD540721CF2A628CF1397F1A6999FA6FE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238178, "uuid": "0a1cf95d-5c4e-47c7-bd81-4d502bba15e8", "value": "e1749d3545e611e4d9029f7a4e8737a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238178, "uuid": "feaadd44-99be-4465-8161-62dc41680304", "value": "6144:JXW9ZNeikh1O8ndkJXejEa2k0aiApP/3gRIBTyw/BB5V7l4NNT:Q9DeaBXOEK0JYhysBLWjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238178, "uuid": "2f0b4fd2-7cb2-4db0-a34f-f1d334d92e8f", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238178, "uuid": "4b267c77-9a8b-4360-bc3f-a74f3c766085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238178, "uuid": "c5f871b4-adec-4852-a79a-9dfabcaa91e6", "value": "63a9df612e56b5ce7645393251e9adbf2291a4e959f743e3eb962a4b0f28904c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43685677-7877-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783258905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258905, "uuid": "0d462319-15f7-4ff0-8b28-f5e1ba1aa7b0", "comment": "Malware payload", "value": "526450e6110bf1461c2b3cd1ba7b0e95", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258905, "uuid": "24bd9b8e-44f0-4daf-89ea-9ca24dc18f17", "comment": "Malware payload", "value": "650399c4b7e9dd5f180cbea6bfe0bb180643d780d9933fa2018fc1089f2c807e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258905, "uuid": "0c74c796-f071-4ad2-a5a9-2592672e58a1", "comment": "Malware payload", "value": "f8dcf4b106742924067b1b1498f74b44e62887df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258905, "uuid": "83b82771-f5a1-43ea-a282-cbfc47923685", "comment": "Malware payload", "value": "66ced733b661512a6e968a917fcdf5298505213079f0328a256f4c51d9ecd2d16196fa6576a812dcc04313b8f42a48cc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258905, "uuid": "8d8d64f1-cf85-4da3-931e-e83b97cf6b34", "value": "T15A137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258905, "uuid": "efb9d604-c94c-402e-bd5a-3ea2267b453c", "value": "768:u+x9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:u+6co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783258905, "uuid": "48949579-4120-40bb-a1b5-f659127066dc", "value": 45501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783258905, "uuid": "4a4e97dc-ac1a-4a4d-aae7-8c062dbd282c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258905, "uuid": "3c932bb1-b036-4151-a907-af9dd12a361b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7fb01b-7847-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Adware.Generic)", "timestamp": 1783238195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238195, "uuid": "08ca192c-0126-4354-977c-064dd40e6788", "comment": "Malware payload (Adware.Generic)", "value": "27af4194b3fb1179eca9bb2ebd511a12", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238195, "uuid": "d63a9a7f-a7ae-4bb5-9555-b929390296c7", "comment": "Malware payload (Adware.Generic)", "value": "65736a4315b49718b68e1a72d24ff61e1b0537f2c2deb19f5bb339f2aa10e459", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238195, "uuid": "10b23188-4705-4935-b2eb-6d91c3bc130d", "comment": "Malware payload (Adware.Generic)", "value": "fb1566a75cbb2034b53b31474ab4d21a7caea50e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238195, "uuid": "fcb05ebd-a5aa-4265-abb9-76b3bac8bc94", "comment": "Malware payload (Adware.Generic)", "value": "3fc279f234b620674576512cfed4cee21c29b85e9299f533b87c1d84bcb853a0f460fecd451ad2b82b73e80958b7e50a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238195, "uuid": "ccb6895d-60da-494d-8c83-255e38f0ebc2", "value": "T180054A3FB268653EC5AE0B3245739360997BBB61B81A8C1E47F4080DCF665702E3F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238195, "uuid": "248faf26-86aa-4c67-a9fc-e4c7092ef551", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238195, "uuid": "0b80ad95-1d2a-4ae8-baaa-8c9e1b3fa309", "value": "12288:FS8cmUDowAy0bgTziwE3UCuaWvBK/QwCg:F7FUDowAyrTVE3U5FbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238195, "uuid": "7b1833c2-b03c-48b3-a428-1ea548084eab", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238195, "uuid": "78a8e440-ff6b-447c-bc52-6aa4d05448fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238195, "uuid": "4aa30ac9-7063-4b5d-928e-ef69dfe808c3", "value": "65736a4315b49718b68e1a72d24ff61e1b0537f2c2deb19f5bb339f2aa10e459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f6b0d2-783d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783234258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234258, "uuid": "d42ed6a1-9fc5-48a0-b3dd-b14a4dce42f6", "comment": "Malware payload (Mirai)", "value": "1b0744331d55e38a47f16fe409c9bf61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234258, "uuid": "90dd9d92-14b8-447b-bda2-604a3eb814ce", "comment": "Malware payload (Mirai)", "value": "674edb7d15668710c3120750f47f88545d1444d22d059d22f8c9dd46ba2400c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234258, "uuid": "fb4bd93c-5912-482a-9b60-105f39b086f4", "comment": "Malware payload (Mirai)", "value": "a630116cba947f8daa57fd2c3be2cfcddfbcec9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234258, "uuid": "2f488443-c1db-4106-82ca-e122d1bf2c8d", "comment": "Malware payload (Mirai)", "value": "4a157beae38a158077a2d367be0824d9589369501c4f01ae35153def6d47341c25389f70671b798c552bdc003daad81c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234258, "uuid": "44db543f-9419-4556-9a53-0f3cf305d6e5", "value": "T15CD33902F48DC0FCC486C1341B6FAA3AA935FDDE123CF2A767D0AB126D8BE61591D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234258, "uuid": "5b345334-c32e-4f91-92ad-03c991ad5405", "value": "3072:WuFDnONmxGrw5oqs+/Yy4210G46nhpvIzxwFrXcGzQH1XViDut9O:tONmxGrw5oqs+/z4210G46hpvAijzAFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783234258, "uuid": "d4cea6c4-8741-441d-b20b-17c3d1eaa3c9", "value": 133120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783234258, "uuid": "267043ad-4dc5-4a11-846e-003ed3547c24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234258, "uuid": "78f024b8-25e5-43c2-9533-5e7a6a2cf862", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fba1c36-7847-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783238417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238417, "uuid": "19055c3d-302c-46f5-9f6b-fdf04c6ff0bd", "comment": "Malware payload", "value": "2ab002b05ec6d9971fa12afda4cca17e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238417, "uuid": "f78e7d70-8af5-4405-bcf5-3441110b9562", "comment": "Malware payload", "value": "678a6632188c067f4f4eed47fa6e81d07c977596d466ad55e4c040900be899d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238417, "uuid": "60932768-fae0-4b2b-8bef-4349670dd33c", "comment": "Malware payload", "value": "3ab001c2dafcb914c606e9d9595c65d976e0338c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238417, "uuid": "d0681983-24f0-40fa-800c-315bd9fd9f72", "comment": "Malware payload", "value": "9cbfb5fefb0df3920a376026e311654ea74c365b4a6af533b87b9f34756b1fa0aab67e5beb0400130a29509f15d7b529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mq12ote0-com", "colour": "#153908", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238417, "uuid": "320f6e47-3e45-495f-8cca-a52be5497a57", "value": "T1B628331D152BE137C8318A70E0E5E67864255D6AD918680381DEFD7AFCF6CF932078AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238417, "uuid": "6033529d-4d59-4e88-a644-3032c4ed5cab", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238417, "uuid": "19692113-cc17-435a-8f0b-4af43effe94e", "value": "1572864:Y3Q5nNfaBdLsHnQugFDzDDPMEf94IPvlhu+nUIzVm8qy4oWska:YuBa/YTgFDzP5d9zVmnBoJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238417, "uuid": "2e498503-d525-4435-9f57-a2b441d95ee2", "value": 100740368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238417, "uuid": "0038ff18-d3d6-437f-a310-2e93430db327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238417, "uuid": "16799ccb-5d3e-4493-9a78-b2a18e6fc3f3", "value": "678a6632188c067f4f4eed47fa6e81d07c977596d466ad55e4c040900be899d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3c3051-7889-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783266736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266736, "uuid": "98c1f768-171d-4d8a-b3a8-946254baf706", "comment": "Malware payload", "value": "a8677a450808a4be8857af5c6cffd836", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266736, "uuid": "fced8abd-db52-4372-ae92-9383c91459cc", "comment": "Malware payload", "value": "68021192f1fe9f396017bcb5ec0a9f64da6b80583790712f6614b306ba82dbee", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266736, "uuid": "9af8659a-c671-42c7-a41c-a2427f07e6ba", "comment": "Malware payload", "value": "91fd716db049df251aeb238e6d283a2937d6a2b8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266736, "uuid": "1df49619-24c8-4ae5-b2b8-6a023ba38084", "comment": "Malware payload", "value": "e50fe0c1d8e9d8e6fd142ce7a9f9fa526ac8a380829f1d7dbf527be019dab0b9372505611188df5715c929bfa901fffb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266736, "uuid": "507e5db4-914c-4d33-b04d-db41941f0bbe", "value": "T1F9E6331862D013EFEBA341389BE0B5A2D8B2B8395775CB5F076887722E171D08D7D366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266736, "uuid": "c8b00f22-73e2-4ef9-9125-d7aa824b4031", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266736, "uuid": "6ed3bbf8-dfe4-4875-a5af-ddfa656da2c6", "value": "393216:7/932dnLSb7gt17cFKRAylKNyEbXMCHWUjXTcuI3/PGTAI:DN+i7gtJcFK/QjbXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783266736, "uuid": "13e34398-fcd1-44cf-a5ad-d87bad100d84", "value": 14318840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783266736, "uuid": "979e9994-bf67-4ceb-91d2-c5eda3fa4463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266736, "uuid": "e5c823cc-c358-4ffb-ae4c-d18ffbaeeb9c", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eacc995-7851-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783242576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242576, "uuid": "4e1e993c-eba0-4661-a074-81e20d8c28aa", "comment": "Malware payload", "value": "10d1b7fd06f6771490b1baaa8afadb75", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242576, "uuid": "1aa6c697-d440-42c6-ba01-e85366d0d7e9", "comment": "Malware payload", "value": "698139f4fb524031ecbeffe71dbf2e0bb23e8b76fe7a844b79c3132d8bedc3bd", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242576, "uuid": "821a83ea-862e-4137-b886-c3eab4d7b38c", "comment": "Malware payload", "value": "532a398aafb409bf4b1adfd7a372813167f4ccef", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242576, "uuid": "b4833622-b0a0-4342-931c-5b9371ab015e", "comment": "Malware payload", "value": "92a145ccb14c7176265414c06dc86cb403304e87afa0d6e8689dc92d9f3715a82a185d4c7ac562142d334e131ad15c1c", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242576, "uuid": "f33d3be6-4dee-4b11-ac80-490e878155cf", "value": "T120860107FCE268B6C4AAA231886291527E71BC543F3163D73E60B7782F72BD05939764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242576, "uuid": "a0d7963d-7f6d-499a-ac5f-285c47487307", "value": "fe9fea8fb19fd7848c8e645e3ea33785", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242576, "uuid": "9376b976-723a-41ae-9c71-3fc67a71a6a6", "value": "98304:vfeKqrKYDqOBT8/pbbnUt2qPYIsjewxoif00sFloaFD5CfxHIJifxseY:vf/SB+LUtvLoeR0GwxseY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242576, "uuid": "155e2ffa-c9cf-499f-92aa-df3511b4c5a6", "value": 8509288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242576, "uuid": "7f77fc3f-2b5a-4a56-a06e-75cc5371357a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242576, "uuid": "6e76e6fb-d258-4743-82f7-d05ff28af022", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88353389-7837-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783231532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783231532, "uuid": "b844dbdd-a08c-4aa4-b452-5fec02f912e6", "comment": "Malware payload (Prometei)", "value": "daf16c414b0f5db38730b44caa85e345", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783231532, "uuid": "3f661dac-543a-4b4e-a5e3-7163731e44b6", "comment": "Malware payload (Prometei)", "value": "6a107300a753a010e466b20ab33177b46224e59164ff8e2c14ae5d3e04f712fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783231532, "uuid": "a42c9f1e-d191-4662-8e7f-91a03a5ae624", "comment": "Malware payload (Prometei)", "value": "dda42e1e9781b4983846f84e6fd5fcc31cdb383d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783231532, "uuid": "0362e5fa-2f43-4522-838e-300e9da8da0b", "comment": "Malware payload (Prometei)", "value": "a8ec91c39995a77db70302dc66c3f0e05350022f017a6881ba4db99de20708ca3669b665233a1aace8e4a509873d39f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783231532, "uuid": "32b1e290-aef8-4928-975c-8de7aa3cd8eb", "value": "T1E8A423B4F9229E8F6DD769B91B24C31DE181C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783231532, "uuid": "7739cc05-8096-4015-95fe-138d39b277a9", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdV:Fs6pyCC/Ya2hpi6T6N4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783231532, "uuid": "6616ac79-877c-47bd-8097-42376f90b561", "value": 449051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783231532, "uuid": "42bae365-062f-4819-a333-f3e6fbcdd245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783231532, "uuid": "0b879743-3c7c-4e8b-8b5d-37d8bd8c752e", "value": "6a107300a753a010e466b20ab33177b46224e59164ff8e2c14ae5d3e04f712fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10359ef-7851-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783242768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242768, "uuid": "f92d7364-c49c-464f-85e6-e61233f3b1f2", "comment": "Malware payload", "value": "364fcee935615aa5bec964ae38b5b378", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242768, "uuid": "a4ff2364-0548-4bcb-ac18-a926224ebc7d", "comment": "Malware payload", "value": "6a9b3e9c2a07ed0279bf55390fe20028ac2a2d3eebb19bdc778937b9bc93410a", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242768, "uuid": "dfd09fc4-78df-4616-86ac-448fdd7b74ae", "comment": "Malware payload", "value": "54564e0a49fd17482c2495f4bbe3024a3f4c28e6", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242768, "uuid": "cf0ac9fa-30d9-4c71-bfb1-c39783ed6d07", "comment": "Malware payload", "value": "a7181663b33507a3a9217d0da19fe4b79b6692ab3e76a88a9d733683e6121170e70af9f22db23446faa6c75bd5b66cc8", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242768, "uuid": "8dfdfef2-25da-417b-a91b-e5da2c5e8ee3", "value": "T1B10833161D02CB7AFD678C766B26AA42C70BD77B0679885B223E1AD1FCF124D683C153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242768, "uuid": "c02ec8f4-e62a-47d7-931e-ed3917d6997c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242768, "uuid": "194ed653-fec8-4c4e-a44f-8527c9dfb15e", "value": "1572864:lt9IKP8dDA2CKxGYFlGmWlwPDOuUJ5UsyuRuGDzp67dt7d8+o+Ws7:lUKUlVcYull+q/FyuT6ht6NXs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242768, "uuid": "d35ea11e-7f8a-4b3b-b98a-2717927509ce", "value": 77765793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242768, "uuid": "2f7f8291-eb28-4896-b7fa-8842a910028b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242768, "uuid": "c4dcf38a-a6aa-4fcd-b540-2a4eb3c32083", "value": "free-claude-desktop.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a2a1b9-78bb-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783288329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288329, "uuid": "dc6bb007-d185-4a6d-aa9f-3b8e14ce1da6", "comment": "Malware payload", "value": "cc025e116f1f73b70da3a37c90db1038", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288329, "uuid": "22cd0afb-dc54-4dcc-8599-aba3240709b5", "comment": "Malware payload", "value": "6af11b40d0a09644d689ea72f10a181cb4936fe8dbe3ab936cde60aa27129842", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288329, "uuid": "b783861a-3cf7-43d1-9621-916f6592529b", "comment": "Malware payload", "value": "55df8af986c156a447a55045f76995f7597fde44", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288329, "uuid": "c98e4e54-0900-4054-b0d6-eee4138c1e34", "comment": "Malware payload", "value": "ca8b0eba5a045999532e43622bec37fa265e645e1cb0bf22fea3fcf1a5a6050e036ecdaf9f2984b93b8336cf3794d7de", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288329, "uuid": "9656485a-4f50-4b05-b621-7e3f2c46da8d", "value": "T17AE6331CA1D001FFEE67807DEB925129F09978664F26C79B57A4C7E25E532E00D3AA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288329, "uuid": "a3ee2bb9-bff1-4a8e-aa2a-6f97ac6bc800", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288329, "uuid": "3b517fa1-5d8c-4b17-b632-edc4a3752df5", "value": "393216:cjoioGXTKQ8HLOQVxt5QgOIXMCHWUjX/cuI3/PGTAI:c8pgTX8HqQbt5PXMb8XUH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783288329, "uuid": "51db10ce-a054-4a4d-b3c2-8ca59cad840f", "value": 14307858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783288329, "uuid": "0a876496-c608-4a21-bf66-2db78f701919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288329, "uuid": "1a5d83d9-d84f-43fa-b380-426562ddd416", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c53ed82-788e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268718, "uuid": "5a6aeee3-5536-44ae-8c9f-cfdef6a16ef9", "comment": "Malware payload", "value": "ea746e5a670db6319b62e1f9af638c4a", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268718, "uuid": "c702b13c-53dc-4b3a-9571-ca9bd25b0077", "comment": "Malware payload", "value": "6b020d4b0bc3e35197bd1e63ebe3f5e9e33ca5334c98fcb65c5eecee1e9a7a6f", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268718, "uuid": "c914a5ec-8685-44b3-8593-6624fdc2cc4c", "comment": "Malware payload", "value": "8c461e35722470ef7842f016897ac1126c24d420", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268718, "uuid": "c77a83aa-487f-482f-8796-5fb4a9f6441b", "comment": "Malware payload", "value": "c9547d4b9828b38da575fabd2d6bf2d1f520650c22732d70e1a78137923cd7f2edce4dda3c8945fe0518d90097291143", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268718, "uuid": "1ebff454-bb3d-4eea-bea0-d30244b503c6", "value": "T146D73398E315518AE2C74FB1AC8A337C72E2C50ED702F15FA4BD15561C13EB82B1BA97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268718, "uuid": "99dc4f54-c61f-4f17-ae10-943895769d90", "value": "1572864:zBTeyszwejWqtj/3BGWRRPd7cIb8ZwR7SjVr:zkWqtj/RGWrd7aZC7S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268718, "uuid": "40efc1ed-288b-43d2-b540-d77b4fc8515a", "value": 58181551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268718, "uuid": "8f76b0b6-c1ec-47b6-92b7-32871a36cca7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268718, "uuid": "fb9b841e-0105-40fd-b384-91441537b476", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52e5dc0-7858-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245754, "uuid": "0de0ab08-3015-453e-9c2c-63fdb1f00564", "comment": "Malware payload", "value": "7d42f327146b01c8ace107da364b0cef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245754, "uuid": "98d5ad32-2c7d-4d8b-a079-c8493e5bafb7", "comment": "Malware payload", "value": "6b7a88ee1c4871671623237f0081b02e2136efd8c1cfb2668fa9a751b4bad28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245754, "uuid": "1ef92d36-2a2c-48c4-9b4a-defa1cf4fc1b", "comment": "Malware payload", "value": "c36821dcc4f4a95caf02a54179b8275f79d7894e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245754, "uuid": "56fe0776-265c-4ca6-9f97-475efbe07698", "comment": "Malware payload", "value": "8f02a5fdc00e77fafa9d13304ccc2519e3d1cad926386b26fcbcbdc4bfccd1fe0747f4c9f1c9b235fd735a613689cd5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Themida", "colour": "#A0DA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245754, "uuid": "b822c4dc-7edf-44c1-81bf-5032afe02f31", "value": "T14C187D03F2A341D9C06AC17587D6A233F671BC0A5B34A6DB368C4B222F76BE05B39755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245754, "uuid": "5fca8aa0-9da9-477f-8a87-a4c62fb4fb4c", "value": "fee2d6808999044373ca2120a0122d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245754, "uuid": "c89aa753-2c59-44fe-b06e-48f572be052c", "value": "393216:xA8R+jJqy2uq3xv7KstO9oCFsqdOrjaj+XvfF42a0ZvMZKfRO13bzwXls8vrnqwS:xA8R+jlnCK0lCFsTpTNvHBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245754, "uuid": "d3aef48f-4d3d-4acb-87e6-8d5e40f41717", "value": 87579648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245754, "uuid": "770d79b0-2449-454c-b48c-1c545e8fe969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245754, "uuid": "13440116-f9a6-4d2b-b1b3-9ddc5fec119b", "value": "Latest_Build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ad1c12-7883-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783264163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264163, "uuid": "c0f3eaeb-87d7-4df8-b73e-cdfeaf7f6a29", "comment": "Malware payload", "value": "20c061772fc694b253d6f5b3506f0ac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sarafinance-in", "colour": "#D509BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264163, "uuid": "f8b77ef7-5e53-43da-8dab-959676a1d393", "comment": "Malware payload", "value": "6bd2482de96955784129b1ece00fe0c90b240021e72bc48ade4cd40a8e2ba573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sarafinance-in", "colour": "#D509BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264163, "uuid": "57dcdcb3-e538-4b40-9293-2ac3520058b7", "comment": "Malware payload", "value": "7cf39f6032ef8e42db72170eebae77ac6204d7fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sarafinance-in", "colour": "#D509BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264163, "uuid": "46222243-5930-442a-823a-ae700f052fd2", "comment": "Malware payload", "value": "90b1ce4fb487bfef1c4789584f2a2eb3b5b49a104730ab1747cab9e253076870d96005010d3c04fe4a25711db8f4437f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sarafinance-in", "colour": "#D509BB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264163, "uuid": "fadad5d7-85c9-462b-836f-af56b83f48ef", "value": "T19AF49D68A3F50499F1FF8B7494B68421DE31BC4AA938CB5F1684529E0D73782ED60B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264163, "uuid": "164e04ef-cdd5-4311-867a-b70065c84dbb", "value": "12288:D9C9s9RMPYzLLMply3OJj6wBxb8ic+Kt0+:D9CO9RrDMly3OJjvxb20+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783264163, "uuid": "e31ea8d9-a713-4a18-bd36-688197ed0cda", "value": 764108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783264163, "uuid": "8220614b-c11a-4cec-87d7-a3f0217b92d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264163, "uuid": "c7a4857a-d5cb-4e1c-af47-065931462a56", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2283a54-7853-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783243709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243709, "uuid": "6a32a3b7-0c72-4555-9ab9-c59e5dfc4379", "comment": "Malware payload", "value": "f5d23115850847a8ef78697f603f79f2", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243709, "uuid": "988b2717-50fd-4ef3-ae62-747b430cb73e", "comment": "Malware payload", "value": "6ca225a3a2b0becac915dc5b9ab44741630f4a75af39d4b10a8b87e091100f10", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243709, "uuid": "2e6e4307-4ef8-42ad-af3d-785cc69cc12f", "comment": "Malware payload", "value": "b501bb712ad0ad2a2b599e93077f7c415944f998", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243709, "uuid": "dfbf3c0b-356f-499a-8e93-c318f3813371", "comment": "Malware payload", "value": "88a409e72820c5e298bda0af3e837350d58df2877fb797b46f94679699b7feec60cb8b3d327c7a4f7298df4b42a072dd", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243709, "uuid": "950b7712-62a3-4729-a544-ca09d62bbb3b", "value": "T11D360896044D40E308F9DBB2F825AD8A7B9E02FF5012959C35D0DCA85B6E18B46FF1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243709, "uuid": "4cc161ef-d33f-4974-bf08-11da2916e74c", "value": "49152:22Jo06xjp/gldvvRb1GRiA1NXa/TUIcY/A:1b1GoA3Xa/TUIBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243709, "uuid": "55129cf1-e9c8-4961-a0e5-b67557158311", "value": 4875888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243709, "uuid": "cc5435af-1785-4651-b5b7-fb3f00ec24f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243709, "uuid": "eab99048-dc24-43cb-9297-8243939ad2fa", "value": "Microsoft-Activation-Scripts.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2305b462-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783219766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219766, "uuid": "cf2ddb39-16fb-49cf-b5f0-de74aa14ca08", "comment": "Malware payload (ACRStealer)", "value": "62fbcb5eed035d28a3cd95bce4c81bdc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219766, "uuid": "846573d3-5996-447b-93f5-63476faf4a92", "comment": "Malware payload (ACRStealer)", "value": "6cb7fd54f66b99cc623bfc38f8aed37b87e36a59882ea770ce30c825bbbe754b", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219766, "uuid": "b4f52770-24f1-4d21-b9ca-107e82074a38", "comment": "Malware payload (ACRStealer)", "value": "4485ba9c695d1d711f5c4fa8d9f255582c5969a9", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219766, "uuid": "2685f4ab-8b2d-4e6c-82e1-9e28feb74e3d", "comment": "Malware payload (ACRStealer)", "value": "a1432f08141c22d9b1cbc9f1ac8840028fabc14404a3ea1945a30c3be1630053d1c07a891ecc7bef7dab43fd74bd6b27", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "releases-cloudgateway-cc", "colour": "#03F698", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219766, "uuid": "c9b214cb-2aa5-438f-8eec-ebd17cee8ca4", "value": "T17C573328F8963A61EC4DC5B406B02DA403F06D76037B5BC42374746FA667FAE9B34A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219766, "uuid": "2ec11e5b-4f56-4e95-b6ad-6f4a7d57d3bd", "value": "786432:SnPIL9OBHBS1Rz9t0EZOWUietXPaVr0VYze8n5jZtzI:rAST4ie+0cei5ltI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783219766, "uuid": "e911b98d-81ab-4e37-a33a-e00960b203e4", "value": 28684041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783219766, "uuid": "fb312017-3542-4fbf-ad53-32d784e4160f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219766, "uuid": "2fa08bab-3a1f-4f0b-8303-d208465fa7ce", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5103ee7a-7806-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783210394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210394, "uuid": "057d7bef-e9dd-4d8c-b31b-13400b345a7d", "comment": "Malware payload (Stealc)", "value": "dc903b2967c0c943084a0d5c0d131cf1", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210394, "uuid": "45db15a9-eab2-4bf5-bf42-bd04d4b227f4", "comment": "Malware payload (Stealc)", "value": "716608d7e9a26e980f916e73792abcb86bbb21fb949436b7f359afcaf730b078", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210394, "uuid": "96eae9da-db58-421e-b605-db0125b6dd79", "comment": "Malware payload (Stealc)", "value": "1dd66d9ee5902947bda7eb381fa256877a646879", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783210394, "uuid": "2a1c6a17-0ac9-4187-bd21-eceb85f469bd", "comment": "Malware payload (Stealc)", "value": "d8b5c2ab6568d99f05d1581efed6f86138438c1a6c78e3757317101400f95a95599b7f2b846edb77e8c6f63cdc63fd9c", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210394, "uuid": "07baba2b-cf7f-4d92-9c9e-380b6e0c1941", "value": "T14EA5330012E409D1E02AA7B05CE74E6B4534F8B24B7116BF35E8967C9F267C5A53BB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210394, "uuid": "b837846e-71a8-4e9b-805c-871aa57214e4", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210394, "uuid": "d60cc885-d5d0-466f-8845-ad3c7848d056", "value": "49152:Au8yU6VTiz0JmAM/UaDjOlgrXcoJA5OZxwvt:VFs0JcJDjOsO5OHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783210394, "uuid": "b343d5e4-b46d-49ea-b0ff-ddabf78e9c43", "value": 2228224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783210394, "uuid": "7de33cc1-d0d8-4953-8b53-2f9b1d763be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783210394, "uuid": "5b22a96a-90ff-4b57-9740-6899de15a255", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84874343-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783219930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219930, "uuid": "6e4f417a-eec4-47b6-b61f-34e7796348e0", "comment": "Malware payload (RemusStealer)", "value": "f344e4d3d76ac6712ddc17a7ac284da3", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2699", "colour": "#78405E", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219930, "uuid": "fc2bc51b-2ade-4633-a27d-7eea6c9fcdfe", "comment": "Malware payload (RemusStealer)", "value": "720035e8c6cfb6cdc35041b7f6fd3883d2dc4821aad56e39f3ca0f2947e2dc8e", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2699", "colour": "#78405E", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219930, "uuid": "43b25290-e6d9-4293-9a50-c18287a10d6b", "comment": "Malware payload (RemusStealer)", "value": "a73bfde9e33db85ab272a2e3b883879fd4c20824", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2699", "colour": "#78405E", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783219930, "uuid": "94c44e7f-a432-4578-9e9d-cebaa50e4f8d", "comment": "Malware payload (RemusStealer)", "value": "ec393ad46be06563649806bc65adc6184eb63d7fe8163cb0684bac53c75974999e77da162157a34c9a1277d5a6b4ea5e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2699", "colour": "#78405E", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219930, "uuid": "4aecbbe6-6314-4a4a-bfdf-99682bf1034f", "value": "T161073387B71B2C0FC7264D819618BBC2E7FE2B726604DEB1456CDC31B88D598A1F598C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219930, "uuid": "c2af3de9-4af5-4719-b64a-b0cf17965516", "value": "393216:aFCt9xmBrjQ5+4X0w1H5E98jVH8/UB0+3xM0DnR/hj0yUBM6/xSX:aWDrXbN5EgH2CRBzJYyEM+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783219930, "uuid": "a01ddf7b-2e61-46cd-bfc3-f5e3263f4d69", "value": 17758019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783219930, "uuid": "2f06550b-fffb-499d-9389-17b6924122e3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783219930, "uuid": "182acf23-1b10-4caa-a6de-f7f75638708e", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6de8e25-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "b87ecd88-e61b-4375-b6ec-4d8901792371", "comment": "Malware payload", "value": "acebffc0495dca59e2c522d8e346934c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "bda0c34e-1116-48b3-8c2f-2935912357b7", "comment": "Malware payload", "value": "722004d1a5c4cba03b4ac26c5b193735b48b164cc0c686923437884a00e8a599", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "9e3b6da2-1f2b-480a-af2b-42a424fdde0f", "comment": "Malware payload", "value": "23c369915b91ad664dbc6cbb768ac4d3942ea12a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "614dafc1-f5ca-442d-9760-9cc500bba855", "comment": "Malware payload", "value": "613ee33f676e3613c4c7d5e4ca12f68e6da9b10e1029940fbb86140b1378344adf3ee7b271a0a2b6a7b62312595d22e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "3a6c2a6f-96a9-41c9-812e-b468512d5664", "value": "T15EF252077A21075FA1A88709E1C54DF98B5AC31C475FF1BE83DED16B140E9CEEA329A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "37c22ed7-4e45-4afd-917f-2702f1291862", "value": "384:n7O1UznYOT1Yqot68NZ8pxAkw2+3xLOlWgT5EYamYZn:QPq58H8XAkw28PKeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247529, "uuid": "082a4261-e734-4f9f-9017-4c464a52fbe0", "value": 37385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247529, "uuid": "4629ad37-ceb7-4122-9fe8-6da2f39d2ce6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "1061b0da-c240-43f8-a650-0e186f3f4451", "value": "payload.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d719c37-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247325, "uuid": "53e81347-0719-48e1-ad7c-bc12ddf617f9", "comment": "Malware payload", "value": "8abe403ac719032d8cf5a7d29de842d1", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDll", "colour": "#D34A1E", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247325, "uuid": "8f37b7a1-913b-4c1a-a393-e6fbfac75192", "comment": "Malware payload", "value": "72b6b09387b1c2a7101d2f9d52bdae176117299eaa6afa7bcb23b4140eb4e27e", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDll", "colour": "#D34A1E", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247325, "uuid": "c66052c3-9986-4940-8d91-afdc226c9d9c", "comment": "Malware payload", "value": "a00acb3a41555b4b8ba678bec39c10dc6c71a832", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDll", "colour": "#D34A1E", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247325, "uuid": "92ef8216-4ebc-4079-99cd-b4d7c7f71300", "comment": "Malware payload", "value": "817724e65546d5a25e67cf1b7da11ce6105742883c63bdf8c85ac6527015c10d64921c6b04cb66bb46467c4db7b3c87c", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeDll", "colour": "#D34A1E", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "WinGo", "colour": "#FC6FCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247325, "uuid": "2c3b10e9-98c4-45d3-bdbf-64a377607454", "value": "T169568D96FCA95CB6F41751768C264589FA927842BF1403EF2AE0B3B61FB77C00279709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247325, "uuid": "a4cb9311-0097-41f3-bfd0-a8fc3031b213", "value": "d203f9672085bd7924a65988545977e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247325, "uuid": "d2bc9636-ec46-4a49-9a78-96d8d54b2b9f", "value": "49152:ieOTiFX7AkOVVMMxZj0AHPHB4ODmd1LHa:iL3tJJGSme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247325, "uuid": "ee06bbe2-638a-4a48-8462-1762e064fde5", "value": 6447288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247325, "uuid": "67ff6eea-3a1c-4fdf-b73b-77a268a5b64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247325, "uuid": "a4181ad3-1374-450e-afa2-9b77b5bb8359", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509f4874-7875-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783258068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258068, "uuid": "70578043-516a-4356-8be3-25c466e703bb", "comment": "Malware payload (RemusStealer)", "value": "dbf9477bf240f517e449c2121eb7a69f", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258068, "uuid": "b6786bb9-45e6-47e3-9ca6-adc05fa3ebc7", "comment": "Malware payload (RemusStealer)", "value": "7604fc93b4e521fd559dc4afd168d833f14ee63908cf733dfdfa8bab02a9d656", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258068, "uuid": "66ed079a-6239-47a6-acf8-99d6ddd6c3ff", "comment": "Malware payload (RemusStealer)", "value": "2c54ebcea5e2484e406a7708584b5454b1f29fe8", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783258068, "uuid": "236bba27-65dc-4aee-ba5b-664bd0eea166", "comment": "Malware payload (RemusStealer)", "value": "08f390479bffb62d59c534e72bb1d8268ba6cadc9f2a0d90dc4a55d8721ac6f0b2d82e5a481b246dbf2b0cb56ae769ed", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258068, "uuid": "c7cd4129-e998-4be3-8835-cdc6e9f95b36", "value": "T16BA55B0B7CD049E9C8AA973288B652917B75BC450F3237D72E90B7782EB27D19D36780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258068, "uuid": "bf08558e-c71d-4ba5-b74a-70b0d8196150", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258068, "uuid": "34396900-f22b-4bc5-8cac-3ebd7bd3f128", "value": "24576:2tOwZW+KYk0lS7+XY5zGPYDKWlYq4e00GLA92mmJtxwBele5rK22DN3Znk37bS:2txYTY7e+IxEcznWLXs8b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783258068, "uuid": "fa669f64-f255-4a5c-b396-a9264218076b", "value": 2216960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783258068, "uuid": "c4af12ee-fc3d-482c-9c20-8415ae504073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783258068, "uuid": "2db1bdf9-c0e9-46ca-9e92-1d930b27ed3b", "value": "recuva_professional__technician_(2026)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c06a04-7853-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783243653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "4b80a63e-d377-4436-9b1e-893feadbc680", "comment": "Malware payload (ConnectWise)", "value": "5e1208edaa128df0809ec8268be38ffc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "125469b4-ef6f-4ca5-b50a-dee5dad34136", "comment": "Malware payload (ConnectWise)", "value": "77f2de0a837eb3b6891f5984a542af71f559afb3d9e9e4e9d0b6cbf1f19a3dad", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "b81d3dd3-b5a5-4734-bb6a-148133650966", "comment": "Malware payload (ConnectWise)", "value": "355109aca5726acd442299528c0e1bb112771525", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "4747124f-f46f-4e9d-9cc6-26c4f344e448", "comment": "Malware payload (ConnectWise)", "value": "59624df7686db4efc9f7b93c1b2abb9b61ce92c75f022c0430986fc9de9c4719bca6e5e441bbcc52d185952a13876074", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "0759e23a-f8a3-4a58-ab3e-431f4e233fde", "value": "T1BC646D11B9C48432C673383107B5E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "83bc46e7-d9e8-4de6-83e3-11a95a19c0eb", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "6b4eaa1e-6208-4d73-a2f5-f7fba2ce9da9", "value": "6144:1mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9U:A1iw7gryNkSV1hy1Z1u2JLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243653, "uuid": "90b491f6-2672-4c46-ad41-85c0f5d8aeb6", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243653, "uuid": "d0a27737-a98e-454d-88b8-b6be870f54f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "8eee5c18-875e-4aee-a082-c5cba55b86f2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6772f081-7880-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783262831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262831, "uuid": "bf39747d-172c-4eae-a57d-6d79fc1c6620", "comment": "Malware payload (Gh0stRAT)", "value": "4013ae1d401d214ccc6a391f48c65518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262831, "uuid": "4934aace-1437-4ffd-ad47-b054a25d21e1", "comment": "Malware payload (Gh0stRAT)", "value": "7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262831, "uuid": "032b47ca-b345-4f8c-8d91-237f0fc5467a", "comment": "Malware payload (Gh0stRAT)", "value": "d6b243db1dbca54dace22f067d2e52938460410b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262831, "uuid": "0cdd8cc8-8c3e-48f6-80d9-ceaf8bbba387", "comment": "Malware payload (Gh0stRAT)", "value": "4fa7d120606ed6e19b84942c6ac27b972677a6d14730bf584070119530d209773e0219dae7772d6c80502d0229892086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262831, "uuid": "752714cc-8929-497c-990e-5bf1212eae69", "value": "T17CC73337B28B253FF0790E3D09A2C14A5577AF71A6124EA54AF8389CCE364C41D3E75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262831, "uuid": "5ce71aff-0b15-4848-b307-70013a21c706", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262831, "uuid": "8adc527b-1c12-427d-bb7c-053c3ad4cb32", "value": "1572864:14vTISsbL+6KXH72B6wMB1b0fGTa7i2h4Q0v7+/b:14v0Vby66HETW1bOk+RGAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783262831, "uuid": "e5523815-b46c-4da7-87e0-06e0f36c515e", "value": 53790187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783262831, "uuid": "2a22a7db-1f17-48d1-a501-6db62af933c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262831, "uuid": "49580f7a-bade-47c1-bc9f-0acc6c9c7b42", "value": "tsetup-x64.6.7.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4404c333-7880-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1783262771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262771, "uuid": "ae363d58-efc0-4230-a1d0-d1e7b9366b19", "comment": "Malware payload (Gh0stRAT)", "value": "3a6c44540d1a164f8ec0f8fb3df901f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262771, "uuid": "06d52e22-f5a8-491e-94f7-bee023ae9d74", "comment": "Malware payload (Gh0stRAT)", "value": "7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262771, "uuid": "c0631ee9-2d90-4e5c-9a2c-2bd33100b029", "comment": "Malware payload (Gh0stRAT)", "value": "4944dbf320a5cdbb1bb39036928930491f4b51cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262771, "uuid": "5dd0275a-b39d-4ba7-be1a-17ecb35bde7d", "comment": "Malware payload (Gh0stRAT)", "value": "ff67419ed6fcf07e0c0c6eee88b9e24d4213eb85c854c9e95b77821270e610cb7715e7a463a5014ecebf3601bbdf3b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262771, "uuid": "ad9f1c2d-5adc-4f07-99e1-7d5a4545be9f", "value": "T162F7331BB28B563FE12A5D395D73D622493B7E20A9228C5947B8389CCF350D02D3F65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262771, "uuid": "56ab124e-cbc0-44c9-82ec-b6ab8752ef76", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262771, "uuid": "969d845d-7344-4635-8649-a0be524eedf4", "value": "1572864:LEvENWhDirT9CKD2KdDiR8Q9VFEcCM1pF/uE:QmvFg8Q9bEfM1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783262771, "uuid": "c3fac33e-bb61-42d0-a528-8ac88e5e085a", "value": 70412122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783262771, "uuid": "29eedb1c-3836-428c-a2d2-20dc9dc0e5b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262771, "uuid": "42d18f5b-8aae-4bda-8f96-fdcb81023e0e", "value": "fiv_EYYtalk_x64_win_Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0146e1e-785a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783246659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246659, "uuid": "ab5559f1-0d83-40dd-b73a-c44f71a0cd6c", "comment": "Malware payload (ACRStealer)", "value": "f38f3e33bfb171c5279faf40f7823b1f", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cython", "colour": "#3DF736", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246659, "uuid": "db97a3b5-cba5-4866-9ac3-6f4972591f53", "comment": "Malware payload (ACRStealer)", "value": "7bb18be4c68d200f9cefb561748f4a7fd7e498ede644c3e1010584bbc3a226e0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cython", "colour": "#3DF736", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246659, "uuid": "31e571e5-a2ce-492e-9d66-c077ef7a8e9c", "comment": "Malware payload (ACRStealer)", "value": "e1ea97079fbf17cf8a75a583cc16e7e9ac035bdc", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cython", "colour": "#3DF736", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246659, "uuid": "a95cd2a0-0158-43cc-8c8a-196737d71c7d", "comment": "Malware payload (ACRStealer)", "value": "6ed90416590a2e19841fe46b7ab18e73058345af0c4d704e217222122edab47d0fe86e75ba63464d5ec4c737b7c35e4c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "cython", "colour": "#3DF736", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ropalidia", "colour": "#ACCE7E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246659, "uuid": "8198496e-05ef-4959-9bc3-dc86bb484761", "value": "T13936235ED8026F09C335D4AF2A9FD8183C9B01BFAF939F17B52669439EC0D4A742905B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246659, "uuid": "3254c747-792e-426a-bb2d-ad9263b8b832", "value": "98304:y/5Xy0d1pW/eNlnPxpEI+0Hs/85zTsrtuKNJqgaHHX4MNIMrE+7K7OXiHOLWws:y/5/HpTpr9M/GXKtUgaHH7fK7OXns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783246659, "uuid": "84861579-d9e5-4fc7-bf32-4c98209d400d", "value": 4899169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783246659, "uuid": "0f9f975a-9adc-47aa-a5cf-795f8d27714e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246659, "uuid": "506dac47-9b97-4611-a624-c94250efe5f1", "value": "python37.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e419a54-789d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783275136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275136, "uuid": "d2c596de-0bf2-45a7-b06c-44457fcaf7b4", "comment": "Malware payload", "value": "947bfef7e8b8a54baf87a1218a114dfd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275136, "uuid": "83f6c78c-4b67-41ae-ae8b-13ccb92a2a90", "comment": "Malware payload", "value": "7c361ea1bcdd134588673954326a11ecf47a08a001b4f1909789480262010ec2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275136, "uuid": "668afa2d-37d1-4f8f-99ad-a5cf335b1c34", "comment": "Malware payload", "value": "77a7cffc2f97e23e3ac3b5334babf577c5c6665c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275136, "uuid": "c7608de7-cd5b-4305-bf1e-0d69beb68a7f", "comment": "Malware payload", "value": "5da8325bd55a2af38bff587395144e1e057739cf8e38dd144f08d7f9e9a8b89c5e9ce7dec2ea0c6a4980d02086d95a9c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275136, "uuid": "4c879d79-7403-40d5-b11e-a3feae61d1ba", "value": "T16C84126A35BE6A5CDE73337BD531ADD7391DE3A5C201841E18A826918820DFF0B1D36B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275136, "uuid": "8b1b7e24-8b3a-4605-84d5-17f04422edb3", "value": "12288:7XqxPEaD58Z7mSxZLNhyMHFdRy1gURMjRqc96zA:7XqxF8Z7maZLNIKyuURIR6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783275136, "uuid": "ac9f6bda-07bb-4215-b1cd-f4a3dc69479b", "value": 394941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783275136, "uuid": "f36588d1-a524-4013-bed3-96cc061d42e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275136, "uuid": "643366fd-ac63-44a1-b5bb-8f3a07620745", "value": "packet-esp-addon-0.1.0-injected-Kopya.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197bf826-789d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783275155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275155, "uuid": "73b57b76-e126-4c5a-b193-f79b44f4c487", "comment": "Malware payload", "value": "082fdb17e9428a27557bb371acdfc0e2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275155, "uuid": "c11f3b5d-8727-4fa9-a991-7780a1d720ae", "comment": "Malware payload", "value": "7e4bcd35ba69658144dcae968c4db1c65c81dde9298df0f9c91679484f9f928a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275155, "uuid": "b3603c05-022e-4341-962a-5c606dab2b48", "comment": "Malware payload", "value": "361683533be83b9e51d1fa91b97a87618af5a155", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783275155, "uuid": "06a78bcb-5109-49fe-b074-2dc5ae508faa", "comment": "Malware payload", "value": "903e6b7ad7862adf07db3e34b692b2428a4a86d4cac999676cde7aa6bcb84f22c109a3cedf3be2a280233a40625b21b9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275155, "uuid": "8d41d8b8-9e12-4cd3-bd73-151bea85e6b6", "value": "T19986335538BCC97BD95737BED9D0C459393628A2F203F23D5E620E67AE05EE40B4A348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275155, "uuid": "ac8e8181-57f2-4046-90ff-f5fc83e29436", "value": "196608:YT/3KXBrf1YH/Kfw71vbdl/8CyDFZOuftXosQR6BS/1m:YzKB6HCf8//uDTOufvjSdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783275155, "uuid": "c398ae53-1d47-4752-83d2-cdb5f6fedc14", "value": 8376442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783275155, "uuid": "2ae28b09-9170-44dc-989b-6b9d23bd7824", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783275155, "uuid": "f4d1ed73-27a1-4645-9dd2-cec673c8d880", "value": "u7or4o4c_NovowareClient1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ba9f57-78bc-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783288591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288591, "uuid": "f5d4d483-c6d5-43b6-8df9-daf9d70aa7fe", "comment": "Malware payload", "value": "5005738452288a8f27142991e6f2a612", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288591, "uuid": "b551ac36-a59b-4dbd-aed8-67c2ecf5dc42", "comment": "Malware payload", "value": "80917e22a9d17c7d856eafc01c1a52b661dddd3820490afb3982aa9fafb20677", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288591, "uuid": "a81b58d0-5ab8-4580-952f-35b74159878e", "comment": "Malware payload", "value": "a43ce0022bde6ce3aa92b2e6359f44cc46b2e2a1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783288591, "uuid": "9624314f-ef3a-4ee5-83a1-6f1bd2f8b7f5", "comment": "Malware payload", "value": "3d15505ab1c7abd64fc2af41e1d60e2fccbcffea786f2a8a0a6ea10166bc0af10fb76c2ca69ef02683cb01f308e0ad77", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288591, "uuid": "1b19c939-2f85-4ba0-ad47-8549f07719de", "value": "T17CE6123BB18AB93DE02A2B359973D160543B7E64AD124E0B96E0385CDF359E03D3B746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288591, "uuid": "ded6c720-5390-4a3a-b6ce-e6df87857bc3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288591, "uuid": "e31ab64c-ba45-4870-8b1e-9140886a59a9", "value": "98304:coJJqWyTwyNGnh4Kv4h+xF7eiSiwhnAw9xjwVNT+Q7refMTOccYBHMdNWSyeLMuo:/1yT0h84LvtOnTx8P+QFOcjCNAeLMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783288591, "uuid": "7f8f78bf-5383-4ec5-ade7-0afb732a13a6", "value": 14245589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783288591, "uuid": "3b6c0d01-ea69-4cdb-bbaa-bc465409a669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783288591, "uuid": "790aea72-3731-491b-a0d3-17bce6f8a409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c10851-7810-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783214892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214892, "uuid": "5c25b703-1a3f-45ba-9831-a6c543007a19", "comment": "Malware payload", "value": "fecfd4c8d58252abb469f6cc26414701", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214892, "uuid": "7cf2eabe-a4c9-41c2-a361-03c2abc2a2bc", "comment": "Malware payload", "value": "848b460096ecaeaf40ed9399c67650a0914967cd8ba35a3e59fbd372ddc2a7ee", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214892, "uuid": "9dd0ec53-5ab5-48fd-958d-0fe0e5381bb7", "comment": "Malware payload", "value": "837578bac7e060af6ba7337b174f0a88a0a70875", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214892, "uuid": "cb5354b4-d751-463f-9cdf-6097def75201", "comment": "Malware payload", "value": "4575dde256588066da97ac57f14ad701e99c5bd9005d07a47ae8761e1066f8650c80a7cf3c13b2acdf5c11183625d755", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214892, "uuid": "36251bde-85d4-46dc-b538-5cdaad76f01a", "value": "T16A236C6516853C24AE99C4375C7F2F0CB9A983E6314491DDBFCA3CF28C4AA9CE21875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214892, "uuid": "b9746e48-c947-4a0d-93c2-81447609e1bc", "value": "768:Yr9NyXsZztCx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnW:GHusZ7cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783214892, "uuid": "2d77b494-189f-4bfc-a4a2-e750951fc976", "value": 48372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783214892, "uuid": "503c9759-d8f6-425b-a081-ee7990a9d4b1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214892, "uuid": "e7b739b0-6662-4d5d-b49b-52c7f7fad870", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fedfd17-7858-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245531, "uuid": "c4bb26d5-57fa-4a98-a9c6-a877f16e6ccf", "comment": "Malware payload", "value": "c164e71aa56c63e5bebdd246949a2487", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245531, "uuid": "3efef676-8538-41ec-856a-2565298ad0e2", "comment": "Malware payload", "value": "856195def0cae78be549ea750168bc950593d131f52b1e0c30aa490856a2bf39", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245531, "uuid": "15876234-1a35-4dcf-baf9-18e0929f4981", "comment": "Malware payload", "value": "1abb0f6dc3c05ca8cce2746d028d360c26dfd243", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245531, "uuid": "8aebdec0-6279-4f80-8341-6154afc15b7d", "comment": "Malware payload", "value": "3e81fceac2c9c2f959bdc659eb15d6f5e6c08279e7303c0106eb373a196a017c31e59e14aa5d0ac00858fcd680ba3b37", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245531, "uuid": "b33a04e7-5412-4b7b-b330-46c5a4a9395d", "value": "T1FE86331ED5117F054321E9BF269FA835399F02FFAF818F57716A69939FC0A0A7422207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245531, "uuid": "babbca53-be65-41e3-9bf2-11d6550b72ea", "value": "98304:XT6sJ1plvYhzA7vOkCjdnB+4XeXupJu8X04IDTdejPzPtFGGh5Q9k03BeaLI/rfn:XTX9mhzA7iK4XeXDEqDwvPxK/orfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245531, "uuid": "2ad61253-439e-4ed8-9076-4ea140ad8cae", "value": 8313908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245531, "uuid": "774e56fa-937a-4b52-93df-dce6b8c1b1fa", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245531, "uuid": "13bac4a0-25c1-446d-b3b0-8b9bbb9f1ed8", "value": "python37.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c065c4ab-7853-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783243653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "8be6b117-a40c-43d0-b95f-772b0c02d09b", "comment": "Malware payload (ConnectWise)", "value": "592c091f5b8dc2d2445618dac9938a66", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "26fef269-e5ea-4965-bf5c-f50e0988fc49", "comment": "Malware payload (ConnectWise)", "value": "87cf4ad614dbe8696401992fb8dde991f921adce680d91057e8fdb7c88e1a8c0", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "576f535b-13d4-429e-a02b-a23cdb7d2681", "comment": "Malware payload (ConnectWise)", "value": "9ab6ffc449a0de80e5af4e690ef361ac01f500e8", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243653, "uuid": "c571c36a-a5a3-4bf4-8279-25ffcf05941a", "comment": "Malware payload (ConnectWise)", "value": "c36c862251048607340067dc228f605546ed438bbcc63228b5b8cf74846e2264a017b96f91d471e740f31ddf7231181e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "9039d0cf-0773-4a19-9914-87b70d3c438f", "value": "T1F146F141B3D695B5D0BF0638D87A42A65634BC108712CBFF57A4BD296D32BC08E7237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "0ed5e740-ed11-4d24-a4b1-629bfaba4f8d", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "accf6c45-8dcc-44d1-b38c-fca638be8858", "value": "49152:OfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:qqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243653, "uuid": "77f373f0-648a-4bcf-8c26-13cb72c50643", "value": 5648848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243653, "uuid": "ca9d4b3d-f842-4163-a079-0be1899452f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243653, "uuid": "07f860c9-cf12-4d1f-8083-86a5493babf4", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369bcc6b-78a0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783276493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276493, "uuid": "332bd9f7-3ee3-418f-bc1f-a8cc6d4f08e6", "comment": "Malware payload (RemusStealer)", "value": "9d5f8c8ea751f483a7d832abc408632e", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276493, "uuid": "bdfb9478-31f6-427b-a3d5-963b4548a4cc", "comment": "Malware payload (RemusStealer)", "value": "8a710cccc278dc81e3fda6081c71cfac7bcfa0099821d7d0a7fab7f415cfd411", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276493, "uuid": "d14702d5-c4d9-471e-b1c2-624ba7204eb6", "comment": "Malware payload (RemusStealer)", "value": "179118d63742640df41341ff249c2020d5ed31e5", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783276493, "uuid": "f201ead7-9c25-44e2-9d80-78cae6ada772", "comment": "Malware payload (RemusStealer)", "value": "0baa705b42f27f02600d3fa0885a0d5ba38d30657b89ddcac22f216183b8f815c7518d2b5ab69bc63b9b823cc9ea0069", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276493, "uuid": "072b9c33-4197-4424-b235-86b25d23fce6", "value": "T133548D19F39510FAEA77913CC9924606FA72BC564760DACB03A04A673F236E09E3F711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276493, "uuid": "320c8807-4cd6-41c9-b425-33b3488ef11c", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276493, "uuid": "1815311c-7aa3-4a2c-9923-73e713620792", "value": "3072:xoRRVcQyFH34xz7XEc8pf0SxLjvsm0klaXiLxp59cUpv8eAITvdE9KtB0CxREHwh:e1MSSRjsmLlwszgMgq2ZIKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783276493, "uuid": "3974c27a-c38a-4b90-9a20-0d61d9671f32", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783276493, "uuid": "3e009d78-ba49-43ed-89d8-562980f99d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783276493, "uuid": "143eca2f-d38b-49dd-aa2b-35420b84cb2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9aedca-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209634, "uuid": "9ef9621a-35ff-4e21-b433-e2572113062b", "comment": "Malware payload (Vidar)", "value": "c1c7abb7d3e27a5a13788863449b0678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209634, "uuid": "a5f78c0d-a167-469c-b16e-acff7e3c09f0", "comment": "Malware payload (Vidar)", "value": "8e3cf3dc6e5d8fdfbcc8575e9e97003f7f919c6ba2ea5889ec3ac658ceacc8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209634, "uuid": "7be29b29-65db-4216-8cce-c318b2dcb383", "comment": "Malware payload (Vidar)", "value": "05842daee782946e80621abe836f235fcb919e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209634, "uuid": "bf40e70a-0d2f-43f7-9163-e9112948dd32", "comment": "Malware payload (Vidar)", "value": "8df29bc158a7ac61dd437a8413e00f0c824d5f737a3cbbc556b710e20295874aed2fba1aab42072af0df711177c26b78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209634, "uuid": "a670063a-f2da-43d1-86af-412f2c0c108c", "value": "T1A8F57C47ACE108FAC09AA23185B75696BB74BC090F3227D32E91B7382F72BE05D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209634, "uuid": "2b053b61-c51b-46bf-8081-9547daf533de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209634, "uuid": "ac829212-2155-4fe9-860b-00c38cd67033", "value": "49152:GDapaeJv7Dz45PGoIk9DdDQ97F+tKSAbB+2avZSFWnLOgCsDpDg:GWhXo2FoAbB+2avZxLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209634, "uuid": "14821898-ca99-4b9f-a0f4-e6b628cf3544", "value": 3348336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209634, "uuid": "3dfe0f57-b9de-4f4f-ab4a-6bb2e32e2f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209634, "uuid": "73c71fb3-ea8d-4035-9423-448f3928cfb2", "value": "SecuriteInfo.com.Trojan.Siggen32.61852.17703.28157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c58e7a-7815-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783217053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217053, "uuid": "e51d4b86-67d4-4524-b4c1-1e6c6d262f77", "comment": "Malware payload (Mirai)", "value": "f9e1d4cc3a9a9d3bdc54baf112077bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217053, "uuid": "53ace636-c6c5-4ece-b2ea-c6000df74cd7", "comment": "Malware payload (Mirai)", "value": "8e8580be4c0807a0141da1e7cddf1763fea514408897d1bf2f7e298198525437", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217053, "uuid": "dbde5c68-ad88-4bee-8bb7-cee3e5fd260f", "comment": "Malware payload (Mirai)", "value": "051ee2689c553541c235bdfdc7be8d1802876c6d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217053, "uuid": "19070a29-d827-4a77-958e-18f5d855c892", "comment": "Malware payload (Mirai)", "value": "bdc838dd6093d247e35f1d4bf626bc8b898a554ee681ad32df74ae34a812cdfcb30a24b38f6af0d791b07d34c4189fe6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217053, "uuid": "866b9b40-efab-4ee8-9208-1896fbdb6e02", "value": "T10244398AFD81AF25D5C5227BFE2F428A33131BB8D2EB71129D145F24768A94F0F3A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217053, "uuid": "435096d2-eb78-4a59-a6b7-95562c9dfe93", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqfPqOJ:T2s/bW+UmJqBxAuaPRhVabEDSDP99zBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783217053, "uuid": "c7395e2f-92da-4182-b270-5b281336a490", "value": 274060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783217053, "uuid": "9a59000a-ee41-44e2-bc6a-00ae8efa47a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217053, "uuid": "958d549d-422a-4145-a63f-bbaa255d089f", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d50049-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783247260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247260, "uuid": "fbbc4f9c-c1da-4634-ba0c-54b64a6b9384", "comment": "Malware payload (Prometei)", "value": "10a57f1268ac635d791a66b8df94a807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247260, "uuid": "ae395324-ac1a-423a-a889-4031c36b39ce", "comment": "Malware payload (Prometei)", "value": "8f2bf0926f75541184a1fad8b31a9442f801cf422dc1762c1a95ca2c2d846880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247260, "uuid": "c89b9d27-d79f-4367-924f-07eed410581d", "comment": "Malware payload (Prometei)", "value": "f720de962c77859e9fa355a194e2236b15805966", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247260, "uuid": "5b2bae1a-cda7-4bc7-8977-89388d0a3a18", "comment": "Malware payload (Prometei)", "value": "8e815705153f4a4f87afd59c8976dcdf4144ea5592ead99df1ffd4eccbf0d1121baeb96a039a0f554111ad1292a3d26a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247260, "uuid": "2a83d1ca-d869-472c-9b38-44e7605d44ee", "value": "T1FA57CF7792067CEDE9B94DB4C41015816DA878874778A3C7BAC8B1E666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247260, "uuid": "80f39ac8-c601-4765-9c90-577372d69435", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEAoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247260, "uuid": "18526957-fbeb-4f36-91bb-9e6402d9dd30", "value": 29720576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247260, "uuid": "b8014491-4843-4e7c-a314-1238916226f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247260, "uuid": "4d4457bd-131e-401b-bc3c-3c9e23ab36d9", "value": "8f2bf0926f75541184a1fad8b31a9442f801cf422dc1762c1a95ca2c2d846880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a609e70-788d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268446, "uuid": "8a4e54ef-19fd-4a3d-8bbc-72b7702d9b8a", "comment": "Malware payload", "value": "aa6bf757257d94836800a5a7d1356701", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268446, "uuid": "c41d4c98-4697-4133-a0b0-4819216fd7d2", "comment": "Malware payload", "value": "8f37d9e74c16fa159a7563c740bf492125ae5c842411d69ed6273731faa99f88", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268446, "uuid": "baca8164-68d9-4e5a-b12b-87320eff444c", "comment": "Malware payload", "value": "ec4e7606fa74f72a331d51a7e76e20edecc6a535", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268446, "uuid": "21666871-af58-4f06-be74-98046b4254f7", "comment": "Malware payload", "value": "775532176c5cb7ec72f7216c66450527d83139c8fe59f060fa7787713542c9513c7fcb74c5f494359b8784a10d14eb0f", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268446, "uuid": "56bf55d2-546b-44fd-ad3d-4d10869dfdfa", "value": "T10B267B22A26401A4DAB79477C5238647CBF1FC552F20D34B41A4BAD92F73BA316EF706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268446, "uuid": "b91731a5-8073-4c89-a39e-b071a1e3588c", "value": "1ba87c09c523d7de2b8992a559808c95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268446, "uuid": "8756b982-4012-45a1-8a24-a743c804881a", "value": "49152:ns2RTSieYuF0LVvfj1oeMvKDA6sKoDfU18BHPbRKQ4bLy7XmngE5+fWqfJJ6JiTz:l2FKIqZsKCfTjw26prGbrHSMfwSrzEY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268446, "uuid": "04433049-eb7a-452d-89bd-d6cd1e2fba47", "value": 4494208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268446, "uuid": "d83d365b-3da7-46a8-bc4a-9a68848a6606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268446, "uuid": "bea8c7e6-b571-41a4-b44b-32b86d025e1d", "value": "python310.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1895aa0d-78c5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783292334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783292334, "uuid": "aaea1a88-e1b5-49fb-a199-f1b54e16c93a", "comment": "Malware payload", "value": "9081627680660e07153a5bee8851d92e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783292334, "uuid": "5129554a-d802-4189-a1f8-b6e95a194c7f", "comment": "Malware payload", "value": "9141fe9327ca1caa1bf70adb61b07caa3dd5f7b5720b617e78a14dd1ca151fb9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783292334, "uuid": "68b85a2d-cdea-4969-9945-c9b3ae5c1218", "comment": "Malware payload", "value": "c8f16a272ccff8b82604f23835ad4d36086404ef", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783292334, "uuid": "2cb2b96b-d4f4-48ab-8638-1c79ba3d64d7", "comment": "Malware payload", "value": "b7244b5ea89e121b0b35c5cc8e28099425dd03bcece2a6bb1ab5b4ab415e2de16c47be075d65d664e47316f94e6b336e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783292334, "uuid": "c2188bcd-cda6-457b-8a5f-bdf289cf8cfb", "value": "T13DA633C8BD8A24B5D09BD3B10AA6603F757D3FD1FEB21D423AE676045D33B12123664A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783292334, "uuid": "bdafaadc-e9a9-4391-8d42-9f140bf7c690", "value": "196608:nEOT4iSGSA1RRQDXigjRVMC7L9oXqcYuUiu+d3QB/g:ntUiSgRWP3MUhoacxZLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783292334, "uuid": "ecbdde03-bba8-4902-ae79-880fc2ede4ca", "value": 9990144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783292334, "uuid": "47d2077c-cceb-4235-95b3-349425b84ae3", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783292334, "uuid": "8d7c852c-dabd-441f-af42-39685e9db01e", "value": "aintall.6638250008.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3c8979-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247219, "uuid": "f90e6749-bbe1-444d-ad62-8efa900310eb", "comment": "Malware payload", "value": "12275b821c3ce2acba63538ab8161a7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247219, "uuid": "57aedcd2-1114-46c6-81c4-10b798884b48", "comment": "Malware payload", "value": "92a0ddb420b6b0dbf1de4bb27d3c929aafdef33640bad790a4329d43c195def8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247219, "uuid": "e1b28f54-8746-4eae-b87e-0b70d695c339", "comment": "Malware payload", "value": "b8279e130aa92f05f5c8e72785aafb89cfe25273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247219, "uuid": "fd43ea6c-c49d-461d-8727-6c37cd8391ef", "comment": "Malware payload", "value": "c0769e82f84aca7771c6e8fec034509f471f6cd63283ec0ce485dc4e1b24636355b72b846826d4d569c4d811ce37770d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247219, "uuid": "d5268ba9-e962-45e5-8646-083aebc6ea92", "value": "T128567DA4ED599E0ED717D3FDC492684B4ECBA6570B8600763CA9C1C992D379089CCF2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247219, "uuid": "1a44f0d5-2a84-46ba-95a8-d9ca2a7a4252", "value": "c9de8759d85c8ed1f1deb14136eb8331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247219, "uuid": "9d9b12ec-66d7-4fcb-b6ea-be2939515c2d", "value": "24576:YrIxWLziTldCJ8mcAHBNd2BpwFNqn/CX9N/Yzx2G6FeX4KafztSuXnNj:YrIxHQvxvYn/CTYzx2sHafTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247219, "uuid": "76f07120-cb5e-4448-ae6e-b9d2475f5a4f", "value": 5889952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247219, "uuid": "23649f0a-fc11-42fd-9ed2-de4a5ecf9038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247219, "uuid": "20eb0968-7b98-4d8e-9c11-beb3309f119e", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbe689e-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209636, "uuid": "cff89dcc-655d-44d1-b596-5a877bf36e9b", "comment": "Malware payload (Vidar)", "value": "1f80fb7d02e567f3c92aed65acd83565", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209636, "uuid": "04d35d54-ed93-48f5-8164-cf59563aa258", "comment": "Malware payload (Vidar)", "value": "9462805f80c946c49bf44a3d567a682b666d1d0bd74e3819050339e6f3e93451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209636, "uuid": "bf073d62-0023-4d33-ad99-302673f7e622", "comment": "Malware payload (Vidar)", "value": "a2229b5da50d9f4c9fba066a7af5c23efbe22675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209636, "uuid": "7ae006c3-7bb9-4880-b953-a56676ab72af", "comment": "Malware payload (Vidar)", "value": "612f114fe92a4518c210abd55a871e630dc289515d5c876f6ec7a40134f07100fed05d50d0fa1562d823687571b33b14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209636, "uuid": "be7a91a0-bbee-4b4c-b6d7-d465112fc1b6", "value": "T1C1E59E47BCD009E5D5AAA6328DB792927B30BC454F3623D72E8072782F767D19C3A784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209636, "uuid": "52cf6378-94bf-4063-a67f-dc35536c3d7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209636, "uuid": "041ddb4b-3b93-4eaa-99d4-dbed7dc9c303", "value": "49152:Hznf00G7buw5Zs0CVmQTqseuqnmHz18cFMIarEftsI4P:Hzs9odscFMdEsIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209636, "uuid": "236c872d-5bd9-4506-a7e7-a80506558f01", "value": 3023760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209636, "uuid": "dc290672-68fd-4b4e-bf08-1ee926f278f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209636, "uuid": "07cfd4e4-890e-4186-9bca-85764c4c807c", "value": "SecuriteInfo.com.Win64.Evo-gen.11482139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c9075a5-7883-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263994, "uuid": "6f4015bb-5ea6-43ce-854e-e6fb6cce7d05", "comment": "Malware payload", "value": "20fff0623859330f1036f030e8f759eb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263994, "uuid": "ac134b6a-b692-4e21-ba4e-79b8dabb9a69", "comment": "Malware payload", "value": "94e0dd4f976cb66058f7aae7b69d308444bec8450065be0e4b7e0351cee5692c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263994, "uuid": "fae8b4ab-5a10-4c21-a5f2-dacfbc84ef4f", "comment": "Malware payload", "value": "88dc157d45eae8f8d22d0930d18bb28396282805", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263994, "uuid": "3ede4160-7998-4cd9-88e9-0a0191f94512", "comment": "Malware payload", "value": "d11dea57fe775baca78c3c0183436b347c81b317763009daf4c474f974963c7b4a83f45bd6dbd5ffca2b1e43edea379d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263994, "uuid": "8844e2db-efc7-4eda-b693-5b82d5a33c47", "value": "T16627235BEF1DF42FC83B4432CF7A522731961146C682AB33A615E10C9DA39869F4AFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263994, "uuid": "b5ee7dda-b863-47b4-8356-93f48bc77d9c", "value": "393216:bHcvbI74ZOF6TKPKxkdJgvkqM6iYUjS4rjdt7t/2zAIm1X+huJ0O+qV:jcvbIK067xnvkqNizS0jdtEzI3DDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263994, "uuid": "28be8e0f-c377-41bd-bebc-5b9f52bf18cc", "value": 21407800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263994, "uuid": "7abdedb2-5e78-4834-9730-647a3ef134a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263994, "uuid": "0d2d719b-9c26-495c-8192-57f1a6d93d23", "value": "Junk Clean Plus_1.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb13f0e4-78a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783277681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277681, "uuid": "03f95804-bdb5-4a74-ba8a-a7c64b7c4bc1", "comment": "Malware payload (Mirai)", "value": "1da2ee39fdbffe6bd12ed8c2830c535d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277681, "uuid": "a8fb0297-67b8-431c-b164-85871cc05e2d", "comment": "Malware payload (Mirai)", "value": "9a9dda2b8029a3f249ea64873416b3be0dab8a5de4a4bb996b50ddc20c8623f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277681, "uuid": "86ad1a73-a8e5-4c03-b428-a56018e3d580", "comment": "Malware payload (Mirai)", "value": "57c1409f8a1ccd3a41b338b1044b530363728c5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277681, "uuid": "ad615796-cd48-4073-9a82-e753f1326e00", "comment": "Malware payload (Mirai)", "value": "b2f2e73e63fa4ee04b9a96e2527efa97fdecf122a89e3d677d0391e002d645ccc29ae83051bf2682c94422d353c69261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277681, "uuid": "7ef43bad-ddb1-4cf0-83b6-141d010a85de", "value": "T1179328CAF401DC7DF80FDABB4467690EB530E3611A831B266757B993AC321E44927F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277681, "uuid": "b570ea73-1a45-4253-aa11-9add7b475cea", "value": "1536:HF9IITVhEXHaW/tw+awWgW0V+WHCEqXZ/fYRJAPm8wUQ2Pl8i5b2ti2DKW68VQUZ:HLvW/tzaGW0VOnYRJoCI7bki4IUXhqBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277681, "uuid": "900e4c83-3316-4784-af5b-5c8640727912", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277681, "uuid": "75af0c21-c51a-425a-8a4e-ae150a926390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277681, "uuid": "2f63a709-9ca9-4ad1-a9de-85d2c311157b", "value": "ohshit.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46e2d8b-788b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783267684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267684, "uuid": "238568cb-3755-4c84-8b72-22d68311697e", "comment": "Malware payload", "value": "215052dfb239a9ef3554d5f8870f27ba", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "iauhgubyag-ru", "colour": "#41BE57", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "ruruurururururu-ru", "colour": "#453360", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267684, "uuid": "ddb67aa2-ad0d-44c8-a309-6f42ae9889f0", "comment": "Malware payload", "value": "9c93454072525b2c4bd008221b42598260f5149135fd18e8df55027d80b54cec", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "iauhgubyag-ru", "colour": "#41BE57", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "ruruurururururu-ru", "colour": "#453360", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267684, "uuid": "d558d7fd-dc97-4160-91e1-61a9452e362f", "comment": "Malware payload", "value": "bb21a97ff12815a04eacac6e74168beb3952e627", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "iauhgubyag-ru", "colour": "#41BE57", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "ruruurururururu-ru", "colour": "#453360", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267684, "uuid": "805bb4e0-1546-4e28-87e2-2559d8875715", "comment": "Malware payload", "value": "7be7f5eb4fc727b278129ecf8e92b43338605d60998ebddaf1853372da8d0e0fc071758e03126b0f9e99ed0c32d49021", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "iauhgubyag-ru", "colour": "#41BE57", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "ruruurururururu-ru", "colour": "#453360", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267684, "uuid": "8f91fe3b-e3ed-4ce2-a594-af65071b75ad", "value": "T100F533AE1D5FC62D3340863459F5FE652D921CBF32ABE98447C00A0E6C8AD629751CBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267684, "uuid": "3858e148-6945-4ff7-9e16-a680a4749c8e", "value": "98304:wjvznXreqKpupY02N2jjCYcHT1zu7ZQ3eMTWxMjL5Q:WziqxpYbN2nCYcHT1t4MjL5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783267684, "uuid": "d837ed86-d24a-4560-ad03-4a818914bdcf", "value": 3617937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783267684, "uuid": "61398ca2-3c48-4505-b06e-9d47ed9d334c", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267684, "uuid": "9e3d96fe-3063-4e33-8cfe-f580ac146f47", "value": "stlupdt.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab63df4-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209605, "uuid": "154e0388-5f9c-4755-8648-45526984f4d4", "comment": "Malware payload (Vidar)", "value": "cb4da97b8dbf3dd30c9d32d2879c67a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209605, "uuid": "84930dc8-8548-4abc-94ca-c574e24ea119", "comment": "Malware payload (Vidar)", "value": "9cd9c0a79450290b1ac0ea3235df6cd68332cc5a426991fa1d53eb7f19ec5a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209605, "uuid": "90cc8675-5dc5-4c0b-ad6e-0999f904b664", "comment": "Malware payload (Vidar)", "value": "fb2d549228df09be55ebc41b0d8d77f0c1d1a77b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209605, "uuid": "2aec16f3-6d48-43d2-99f0-1c1dc66517b6", "comment": "Malware payload (Vidar)", "value": "fcda11c506e788af5e567a47319317764fe9405684a4711a6af538756b18d09d794933790fad1fd5d1df8acf17ca5368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209605, "uuid": "de77adfd-66d3-4e1b-a861-87e624a9b825", "value": "T1CFD59D0B7C9148EED469A2368DB611567B74BC190F3663D72E90B7383E32BE19C39784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209605, "uuid": "146e4739-ef1b-46cd-a7e6-2fd4d8000fda", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209605, "uuid": "c0d25087-f018-41b6-8a1c-3f0d9b4f28e4", "value": "49152:p8d+qC4D+FuDYoLQlfwZqVuFm4s5jlWOojvpDIcR4gE:p8w9qQlfPVuFmNjBorpkV9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209605, "uuid": "9f1a149c-3a51-4199-b6e5-83b6183c2bba", "value": 2961816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209605, "uuid": "71115109-1979-4164-90d2-207458dc4430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209605, "uuid": "c4064035-8222-4d52-b18d-62cc3f64f529", "value": "SecuriteInfo.com.Trojan.Siggen32.61904.18316.7310", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bc2fd47-7840-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1783235216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235216, "uuid": "a2787c24-a578-44c3-ab64-645c3e73df70", "comment": "Malware payload (QuirkyLoader)", "value": "23938cf31c1fa4700341cab81b0f3243", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235216, "uuid": "1a770acc-1363-47f0-a142-452d9558797e", "comment": "Malware payload (QuirkyLoader)", "value": "9df5a7b74fadadc12c289fff3f5c7f58e3893e5a36df8a287b1f69e588a7e818", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235216, "uuid": "c8ad714c-2261-479b-b0ca-bf274a2d8649", "comment": "Malware payload (QuirkyLoader)", "value": "a041d35efc838a8d88586c2ab38f3740b8f543d8", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235216, "uuid": "cca44037-63bb-451e-a718-3f1db2b8e385", "comment": "Malware payload (QuirkyLoader)", "value": "b5309e42bb441bc00a4b001c880cf951502e6d74fed5b5c150dd5e3804868c8e1ca238c06d3ff292fa18faa889a86e40", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235216, "uuid": "d505803a-f459-48f5-b69c-b47211a33cd4", "value": "T15B079E55A3F819E9C716DA348607DE32C2B2B9624B77908B0BDAC3471E77B514B3FA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235216, "uuid": "8c667d43-07a6-45f9-a34c-d2bb83d75e49", "value": "6e960848e4c134c76f5c6e943cc61578", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235216, "uuid": "b3d99491-d9f1-474a-8720-46ed5fef1488", "value": "98304:btUl5+dcE5yZWORKMeqfSO5gdIN+7MvUMO4UWpaHQnF8XpgTAgs6pUg0:eAdXGWORKPIm2N/vUMO4UWAwF8Wvs6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783235216, "uuid": "5c412287-4a39-4005-930d-193dee7f7bbf", "value": 16936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783235216, "uuid": "767a3fa3-e8fb-4bc3-b4bd-9399ec1dbb3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235216, "uuid": "0987ad8a-dcb6-4dc1-9add-34fd282fedb7", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1983dbc-78ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783281933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281933, "uuid": "ff76aade-96b5-4515-84b7-4c37a5fdf48f", "comment": "Malware payload", "value": "1a84ea2504cabb63e55c94c3ce87548c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281933, "uuid": "494be519-f19b-4a04-8b35-4a9f235346e4", "comment": "Malware payload", "value": "9e7fc2c6be8d695e8fbd0ac57a9a3775dece9a04de9be98329ea7bec91857550", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281933, "uuid": "51706491-854b-4f45-ab04-dcb543090e20", "comment": "Malware payload", "value": "bc8e9a7fdea9789dff9db60ccc4922075199a213", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281933, "uuid": "68a58518-8c6a-41ad-8ed8-6b7ccf9a22d8", "comment": "Malware payload", "value": "486746996c7b5a04ea25aba00289c65d5ccfee8ad9fee5d0853aa1266363e7d634bcbb77064b14f50b3ad6249ad46e22", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "P", "colour": "#A08B48", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UNIQPREM.file", "colour": "#C4EDC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281933, "uuid": "6d5220f3-8336-4222-aca1-82440cb7e93f", "value": "T114C58D4B7CE109E9C8A9A73288B252917774F8050F3227DB2E9077782F72BE19D75748", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281933, "uuid": "c596f2bb-3f2e-4dd8-b883-b9e1b566134b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281933, "uuid": "8bf1e941-4b34-455b-a228-7349faeba0a5", "value": "49152:4+Lp/8hzksuGMSsAYaUM11AVuKkST3h/DZq:4+x05cMJKkST3Jlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783281933, "uuid": "c3aceb70-7fe1-4c14-b2b8-c37bcc8eb472", "value": 2722672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783281933, "uuid": "913b495a-099d-465d-842c-afa234c8a531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281933, "uuid": "6a48334b-7163-410a-8b99-52ad50e4e760", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c353ae-78a8-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783279904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279904, "uuid": "fe3e9d64-faed-46d5-a08c-b01ae7ab1fa1", "comment": "Malware payload (Mirai)", "value": "a4c0f75eff43ef702aca72df79d88768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279904, "uuid": "9e846070-ced9-4e63-aabb-0fa70be1006e", "comment": "Malware payload (Mirai)", "value": "a0ddcc91877481c641effcc9ac6d1dc918f24f7dd3f7efdc21e399779c43a01a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279904, "uuid": "2b7428a7-78f9-4269-bd54-7d93ab818c23", "comment": "Malware payload (Mirai)", "value": "7ed70c815b068a796ea6536d26d428a568d2a607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279904, "uuid": "9ce0b050-3420-4fc0-8275-bc1cb0188228", "comment": "Malware payload (Mirai)", "value": "ee9925d4c26cfcccc9cf8895b7537b845a64a66b9c421c594e72498013041348f1a480b9a8ee6039add004d67610cfa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279904, "uuid": "bdc6d48e-7e08-42b0-9a89-bacabd268ca8", "value": "T144B32A99F490DE62C6D4267AFA5E218D33134774C2DA32068D149F3137EB9DA0B7FA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279904, "uuid": "3028d928-ce89-4f8e-82e8-f0e2892603de", "value": "1536:EZ+7WhcYRDB3wjvlVfpVPUIwj/aY3Q0KF3+ukcOcKzmNO1szl+FqUs+KPVzDr2GW:NAcCubX2jSYZKgRdmfruK9zD5Ty/XT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783279904, "uuid": "a2c797d7-e4bd-4c07-b536-ee4ee747c3a2", "value": 108076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783279904, "uuid": "f283f081-decc-4eaf-a9bf-e31af3a2f392", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279904, "uuid": "30e7c7de-2c42-4efa-830f-954ae4e4d6d6", "value": "ohshit.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100845d4-7840-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuirkyLoader)", "timestamp": 1783235196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235196, "uuid": "80e2c8f4-6393-4589-9c7c-65ceb8be9ad0", "comment": "Malware payload (QuirkyLoader)", "value": "cd613875486e3e5457d4513aff8ad75b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235196, "uuid": "404d9ba3-0497-4601-9c86-ef42476dd7b9", "comment": "Malware payload (QuirkyLoader)", "value": "a2abc9d8dc1bfba97a86ba091dd32222c0864accf3e8bd7d16da2d092a518a44", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235196, "uuid": "f86bf754-b2cd-45d0-b35d-51ce7342443d", "comment": "Malware payload (QuirkyLoader)", "value": "002b11d193e0af1612442abc7ef7e37a9efcf78f", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235196, "uuid": "2a601429-c4a6-48c0-a80f-87e3375768e7", "comment": "Malware payload (QuirkyLoader)", "value": "a5ce66b00a2958cf0b01f40c0bd36c8c559aea9a928df1c2535e6a52e1eccaa904895f30a96d55ccd31da1a586e1105e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "QuirkyLoader", "colour": "#16F92E", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235196, "uuid": "8b01b82e-f236-4abb-b6b3-83c9df9f6022", "value": "T191263344F8EB655DFCAB0130DE942FD1C3620076EDC314D71A924AD2D0DBA54BBA6E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235196, "uuid": "106679e5-64bf-43af-a5a6-1af6225acd12", "value": "98304:XXrg18sb7bEU8oDg7Kd1GvrkjfMkxbkfq/jvVLOrn40K0aBfrzp:X72lb7bEtRKd1Ga1b02vROrkpzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783235196, "uuid": "0ab630f6-b342-4b0c-ba42-4be233ee5574", "value": 4511238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783235196, "uuid": "04e0fe12-1033-4380-bd8b-6a62a4ebd614", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235196, "uuid": "cd7e8e33-2f80-472f-bb22-8eda90b3e71d", "value": "kenwillzltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ff2de1-7863-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783250487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250487, "uuid": "ca60cee4-1692-4d61-893f-e69978831a3d", "comment": "Malware payload (Prometei)", "value": "fda22b999ad7586aff9a09d8b4a3040e", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250487, "uuid": "7d86af14-78e4-4f83-9218-56d71bc18e4b", "comment": "Malware payload (Prometei)", "value": "a38cd6347a25217e8d8e35eb0ea6f054786421e656402bf2f2fcfa70aaf86631", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250487, "uuid": "2390d31e-e54d-4280-8401-e51fed8c383d", "comment": "Malware payload (Prometei)", "value": "5821c9d12ecd87001d36312082169c1028d0fb2d", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250487, "uuid": "a17d3920-3ca8-4d71-9b7e-f9d3d3cd8a3f", "comment": "Malware payload (Prometei)", "value": "6904dff39824a3a13e76e733fc4243b25a0aa1409f9466a2f3208c96d9c8105a15fa7890d8b0c8415f71b16ccb447fca", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250487, "uuid": "b0144fef-726c-42a2-952d-6b55316c447b", "value": "T139B012F703330CF28C4008C0A360CC49D90DC2C4DC10C4FC8F4C10210140D042004A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250487, "uuid": "ab14fbb3-06d4-4c7c-b4a3-64de9efce701", "value": "3:CU2XmhYVuyHEZaKzOdoEJzNuvhg:a2hqu9ZaKrEJhgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783250487, "uuid": "b6cec4fa-2f02-4daf-9ec9-9e911b57d9b9", "value": 99, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783250487, "uuid": "92eae698-df91-4994-bd83-e1a82ed49ae4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250487, "uuid": "e933dce7-666b-4b36-ab5d-8e96a7fbf63c", "value": "a38cd6347a25217e8d8e35eb0ea6f054786421e656402bf2f2fcfa70aaf86631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c125a125-78a6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783279302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279302, "uuid": "e1ca3d8e-4e5c-48d6-a0fe-c0a768f4f8b1", "comment": "Malware payload (Mirai)", "value": "47111f985b27836a391619d73af788b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279302, "uuid": "c25e2c6f-ed08-4313-a26a-d1f24e8a20a9", "comment": "Malware payload (Mirai)", "value": "a452bec6a3870ff512d0bf8a2c01b9e052752a6a1c6b1c2b8dd4e61d97cb611e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279302, "uuid": "f4cd58f5-a975-4cd8-a5c0-a7ae9f16bb22", "comment": "Malware payload (Mirai)", "value": "4a16ada0775173e79b4291e5924c022426498f9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783279302, "uuid": "ae343795-0f38-4d88-bec4-a05d4bae990f", "comment": "Malware payload (Mirai)", "value": "88a42252c845784b5ad9747d34d519988105465954d006ff48b478cb0ebb0338e3fe23e823cd84ca19c9cfb3055d51cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279302, "uuid": "faa5e846-4142-445a-94ae-8a33567aabf4", "value": "T137935B22B5391A2BC8E4947612F75322B1F6478A14B88B1F7DB10E8EBF245D03A477B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279302, "uuid": "ad519753-6e26-44f1-90ec-642d3c30f93f", "value": "1536:mco9F6LYqitt+y95zBA1ke7BI/ltvXXYm5hRsQDEYttcxn:mxGUIFoVnYOhGScxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783279302, "uuid": "b43bcbaf-c777-4898-a221-280103f26cdd", "value": 92888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783279302, "uuid": "427583a8-70c2-42af-ada1-8fefeca6d68b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783279302, "uuid": "ba87cd28-aaf3-4434-b6e4-90d2bb172783", "value": "ohshit.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1064e39d-78ac-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783281582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281582, "uuid": "0aab0c71-3ef6-4b47-a37a-d23b80ccf20c", "comment": "Malware payload (Mirai)", "value": "044a8fac2313d52887ee522ad88951c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281582, "uuid": "0e36d9a6-d567-49db-a64b-0074090d570d", "comment": "Malware payload (Mirai)", "value": "a479ab28ecf91731d98fdd22d105c33368fa9611fccd03804c062235ce5db235", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281582, "uuid": "c505c6db-34d6-4c87-9991-a0b2086bae55", "comment": "Malware payload (Mirai)", "value": "292495012fb40eaf6d555647c3a9036f876cd607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783281582, "uuid": "c2123c31-7915-465e-8b73-feb3103285bb", "comment": "Malware payload (Mirai)", "value": "56e039f3a35139c71e24bfe9fabc2e87ca5f11fe2089a3da1250521b09e606e13feef5e1716a5119ce7d017ab228cc53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281582, "uuid": "b589e893-574c-4724-9ed8-ae99fe106db8", "value": "T1F3933A45FC819612C6C1137BFB6E228E372663A4D2DE3207DE156F22338669B0E7B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281582, "uuid": "a0748485-81ed-421b-a6e9-b39dd46e1af7", "value": "1536:hhSqXp6DAmXTFxfLGxROZ02ZpcnDZxnnBdlDO9vSK6:hhSqXp63X/fERx2ZpcPnaSK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783281582, "uuid": "1fc72b42-ecac-4e7c-9631-5fd5f9859956", "value": 93140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783281582, "uuid": "91a5ac1c-6bcd-49df-a026-3e1a9b04f825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783281582, "uuid": "d10000ea-e9ab-49b6-8055-e3ece0529ef7", "value": "ohshit.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63356db-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247528, "uuid": "8c68e6f4-d786-4c0d-a154-0102734aae9d", "comment": "Malware payload", "value": "d60346fea33dd56ae49aa993f6ce7e2d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247528, "uuid": "bb78853a-7876-4a45-889c-541e67b0d82f", "comment": "Malware payload", "value": "a4b58acf65cf16bb31313896a6183f1d597336069e1ab537b61777157b695dbf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247528, "uuid": "e5c2a680-f236-435d-82fc-0d7e23b28164", "comment": "Malware payload", "value": "421d607246f05da4110cabdf5c86530e312521d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247528, "uuid": "ffd6f77e-c883-43e3-9044-3ef8f78eac04", "comment": "Malware payload", "value": "2f0b5ba6f31f67fb82d27f73544fa614afabf8e0ec32a4fb11961861adbf311923ae833186f95c4cc7dea611eb88328b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247528, "uuid": "340c2ce7-913d-41c2-95c3-34ac5f4dd6d6", "value": "T15DF047D6359A94548F80C250474FC56465CD8670ACD09986D5BC01182ED1BE4596320A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247528, "uuid": "bbe1b5e3-2ead-40a6-8d9f-31b91c615e8e", "value": "12:vFnZtlLlB5dxGXGe9MBqcuhJnCYLRLjoHN4PdwIzkQBjqfjMEzjdYzn21sPQi247:dnZtLBDoGfYLCYLeArzkQBOfI+pW21sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247528, "uuid": "2946fa6c-9f2d-4e38-b2a8-635da6adab00", "value": 577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247528, "uuid": "64b09b0b-d16d-49e4-a97c-793250b04704", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247528, "uuid": "6c511034-a940-4524-987e-71feed52384f", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88558ca8-7857-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245276, "uuid": "68db046c-c1b6-460a-a0ee-21bb99ce4a8a", "comment": "Malware payload", "value": "7eda906ad26cff69016f24cadacae2b4", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245276, "uuid": "ff9a1bd4-090b-418d-8120-e95c138e3791", "comment": "Malware payload", "value": "a616c9a41262714bb781447d3e37a09b6fd636e79d8381097fb923a109c53298", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245276, "uuid": "f461d36a-f5e1-4b4c-b1c8-0c18a565768a", "comment": "Malware payload", "value": "844abf89c757135896a98b6077682f3037f58eea", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245276, "uuid": "5deee7ee-2d5f-4988-8736-e147601fbb11", "comment": "Malware payload", "value": "5747f228b1fcb2a9cf6fe91df56f8fdffcd59b54152a3bfc6dd87942f66827023fdde898330cc0fbe4816a217c39add1", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245276, "uuid": "7029dfea-b074-4aea-a074-b0afc6f1354d", "value": "T17608339CD093C249F33B59FB09F19E716740678D1EE598CF2A880115FCE248A65FC9BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245276, "uuid": "5f8dbada-dee9-4cbd-9379-9bbde6e08afa", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245276, "uuid": "1e73dcc2-47ea-40eb-8b73-2df55b7d1fe2", "value": "1572864:Ot9IKP/bl0RWY5XAJiqL4i5hjf55Sp1y/5m352GvKTe5Mmd7:OUK3R0RWiXA0U4i5hjR5KyRC52GoeimV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245276, "uuid": "93a7f806-18c3-4d0f-bb7a-d6f7ea1e6400", "value": 77632077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245276, "uuid": "7c05cea5-6785-484d-a694-9dda5ab7d0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245276, "uuid": "9b0b5167-a18a-4d1c-bf1a-4e1404e66dd4", "value": "MultipleRobloxInstances-V2.2.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a26a64-7886-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783265240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265240, "uuid": "9a8a02db-6e30-4448-b5e1-0b3f5c12d101", "comment": "Malware payload", "value": "2c753a9b9251544233d629b439f2d36e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265240, "uuid": "6a342a9f-4787-4d5f-84bb-30a9cf12ee60", "comment": "Malware payload", "value": "a99fc2710b0af6f1d0be97a3a380a3dec7ff08b7daa765f6f52944cbdcd3ef48", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265240, "uuid": "039df389-cfc4-4be6-acd0-3b0ea6be5a13", "comment": "Malware payload", "value": "da54b1bf14a6ab5147374232d5e39eb9432016f2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783265240, "uuid": "fa997493-b37a-4646-81a4-4b0179fe49f6", "comment": "Malware payload", "value": "cf3d4ca23210f82c193715ac9f7efa529509c193c63834d5c742fcdf9bb28bdc48eca7ea6363d2a5ce62180d8fbb6dbe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265240, "uuid": "0b34147c-1dbc-499a-bee5-cafae8a16407", "value": "T17AF0E18C4E21EF75994B447D635A7C5DD4D29F3A194F85100352D650ED14B84B1CB328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265240, "uuid": "597df074-a749-483e-bbad-8418d55aea8b", "value": "12:1XJeGDW/WLCLQorgvML7HXLWxjxEpcmuULmxSm+ZFFRmN7:dJ5QWLCdaMrLIjxEibULUSZF7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783265240, "uuid": "f492aeb8-52eb-44ea-be31-d06b2f9e5fcb", "value": 559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783265240, "uuid": "f9531fa6-4dc1-4036-bd01-36965815bf83", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783265240, "uuid": "a7d90547-1a37-42ac-a356-11af286b74a0", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a775c31b-7865-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783251342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251342, "uuid": "36140018-de47-4474-aa05-8a8caa67caa6", "comment": "Malware payload", "value": "181f93161f3807f43615e167ef64876b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251342, "uuid": "8bc71474-797a-4a47-b897-2c79371c17de", "comment": "Malware payload", "value": "ab1a37954a80caa25377ec283ea5c9bd9e9ba0a270fea25619cefcf253657bd0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251342, "uuid": "594963ae-cab9-42f9-91bb-0e62fc2feda2", "comment": "Malware payload", "value": "7a8011048d6c86f09b242e87a59875097bb2b7a9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783251342, "uuid": "455284e6-cb68-4788-899f-8e0cce15d60f", "comment": "Malware payload", "value": "b0495ffb89add2bb0652827cd4d2744fec32952c8af88d01755c99fbc61ca28d1f533c89be135a5d4d8fc6323bfecdd5", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251342, "uuid": "94fc913a-9302-43a2-b1bc-80a187c33f90", "value": "T1D5D7BE0777E60195E5B3D2388AAB5103D773B8665730CBDF329C06552FABAD09E3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251342, "uuid": "01fec765-74b8-4afd-bad5-e78985761fb2", "value": "bfdf360405e2a60f93db21d6a40d07ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251342, "uuid": "fb01f07a-738f-4c78-a13f-0dc537c78921", "value": "786432:B2bdawMCJXrAxOhMWVggXNYddx9j4VYO9b9/1/P:BwEwMWXQwMW2kNwdn4VY2t1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783251342, "uuid": "12d0ffbc-56fd-422c-bc17-7b9858d27b78", "value": 61986999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783251342, "uuid": "f14d4df6-f5c6-44d8-a576-3caddb3216cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783251342, "uuid": "d012f349-6c22-490b-96b6-c1c2d370f723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3127962f-7857-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783245130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245130, "uuid": "6d97a808-c526-454e-8ba2-4a3e6ca54be0", "comment": "Malware payload (Efimer)", "value": "fafa05e543e97b4a881b864b5b4babb6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245130, "uuid": "2484536d-97a0-4876-b3ed-a386b463284b", "comment": "Malware payload (Efimer)", "value": "aff0445b3068a5edbb0a827fe06bbd1153d8939c1709f997d8f583252ba71359", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245130, "uuid": "0f1eff2f-e705-4c17-8d95-eabf7cfba958", "comment": "Malware payload (Efimer)", "value": "243c572dde1e2562bf66e526693a4ef53d83e185", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245130, "uuid": "c265c542-b996-48e0-9deb-d0cf42dff732", "comment": "Malware payload (Efimer)", "value": "ffe07dd2f29b16154889a7ac1cb4503daa67f95377edd307adba02a1b12fcf8c4881b6373e8ec23f937750ed2ee8985f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245130, "uuid": "cabae518-eb8d-4c43-9ed9-f7e3bcf6eb3d", "value": "T1B0E63348B6D40AEED673813CEEB25144D4A234A54BA2CB8F6B888B717D572D21C7F743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245130, "uuid": "ce91fd2b-c957-4f7a-8765-6bf419ca5892", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245130, "uuid": "f09a29e6-7f4b-47a8-9246-eec2887da93a", "value": "393216:OU1Cp7P2owzm8pLktkXMCHWUjXjcuI3/PGTAI:OFpr2oqx3XMb8XAH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245130, "uuid": "18295f43-1103-40c7-805c-79223aff8ef7", "value": 14284031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245130, "uuid": "66fda6fe-600d-4b5f-8f0d-d5731e72209b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245130, "uuid": "2a15c7e5-c836-436f-aab8-83cc191b9939", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d69891e-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209610, "uuid": "0509ae2f-942b-43a0-84d5-68682acf8bc3", "comment": "Malware payload (Vidar)", "value": "2ae339b769bb7b5ec637d243e07a349e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209610, "uuid": "5e01e139-51af-4ff6-ae6d-def7b358a1d2", "comment": "Malware payload (Vidar)", "value": "b19e9f8b8b5cefd798ffd7a3b428aa842798d697a049f32cf80c720ccb5602f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209610, "uuid": "627fde94-acaf-4409-addc-f8085525b72b", "comment": "Malware payload (Vidar)", "value": "51c82d82b7e8e89521e4f3259524fbc2a4b8e595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209610, "uuid": "b26cf455-6cb6-471c-b873-3ae5288f9a58", "comment": "Malware payload (Vidar)", "value": "fc3573569d80e5dc17834481c83dc9d27342ca3af62fc78ea988b85c1f2a9d0ad0015b246bdbde73631a74bd50f5b241", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209610, "uuid": "242a82c6-5cbe-4d20-a2a6-663db22e4483", "value": "T137D5AE0BBCD508E9C4AA673588B201967B35BC4A0F3263C72E90B7782F727E19D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209610, "uuid": "b812c5ec-d135-47d3-8408-3e1fe772f48f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209610, "uuid": "50fc382f-8124-4f35-bd99-8789053added", "value": "49152:OIWQYezEREEbDncQtLiwhjsVhzPqsBbcUVgwN:OIKeBQtmojsbzPqsBbTV9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209610, "uuid": "15615662-d233-477e-8ae0-159a235580d8", "value": 2956688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209610, "uuid": "2d230566-1382-484c-8ab4-634da5f20ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209610, "uuid": "972187e6-34c7-414e-851c-b9a39c5ddefd", "value": "SecuriteInfo.com.Trojan.Siggen32.61915.1296.13418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c278dd3-788a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783267080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267080, "uuid": "54a537e5-54b9-4fdc-b6ed-1097dfa3f40f", "comment": "Malware payload", "value": "3467c71e888a305838de885f05aa1d89", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267080, "uuid": "859bb39b-eb8a-46e0-98df-43d7737b7250", "comment": "Malware payload", "value": "b2a3b67fb3ead7e3cf774ec6a3b09d0b9a2e99b273896e1fb7f5c38c564b8ab4", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267080, "uuid": "5b33126d-e061-4bf6-a696-d17620b45127", "comment": "Malware payload", "value": "fd88e04c1ded0de78f188989da306dbb00243e51", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267080, "uuid": "d81d63a0-764f-4239-96fa-36a243bc7206", "comment": "Malware payload", "value": "3bd5007f3172e2de510277de8d1b6c925a539abda80a191dcf0484941b11005d6f6c5f4fa423a5020c91223ec0b1c93f", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267080, "uuid": "b8eb80f2-5a31-4d28-bbba-e5a1e5b1552d", "value": "T18F16336050D489E5E6F74B742AF74561BA3178B24EB4267F25CCC5AD3F325C0AA32F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267080, "uuid": "a3a31d57-380b-4f3d-9453-53deecd7e8f1", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267080, "uuid": "d655a2cf-c044-4b86-9ab7-e3aeb517c9c8", "value": "49152:uuc44qAjS++OhxdQKCCnc1LYnfqWd3LpR3LaAZugE6QcZZhn4i3/:jeZ+uLMLYnF9XEiHn/3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783267080, "uuid": "8dfaa90c-f30b-47c8-ae63-704e0e418760", "value": 4378624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783267080, "uuid": "64135e20-1f9f-42f4-ae93-9296c52b75b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267080, "uuid": "bf0323ff-f758-4abb-8059-a23c9916d393", "value": "2JokesBallon_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03dbce69-7882-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263523, "uuid": "b5b675c9-a302-48c5-84f2-55e1a08933cd", "comment": "Malware payload", "value": "9adb95ff32de9a11a9fbc7f9c3947a2c", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263523, "uuid": "45d1c09f-9417-45b0-9c6e-c511bc4fa433", "comment": "Malware payload", "value": "b3edf72ee4f40a89d95badd1c3bd81e077f8d89248a857384ccb05a14765748e", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263523, "uuid": "61a0e3e3-b0aa-4077-b357-9b674de442f2", "comment": "Malware payload", "value": "80ba1cf466fcfab7d9488ad23a3cd1518015475b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263523, "uuid": "e448ba8a-bf3b-47da-8454-21f6b2b5e76c", "comment": "Malware payload", "value": "c693ac402dab879bafdf248276c725c07572d433b83d48681da3b55eaa783bacf28ee2e474b6c9805b652e8904b4a69e", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263523, "uuid": "22486444-d1d8-456d-8c8d-191b23cfc910", "value": "T1F6F6F109F34DD82ED9B7B0BC4C5606AA611B2C455B11C3966C19770CAAF77E84F2EBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263523, "uuid": "f6c0c05d-ae8a-4b4e-8601-7c4a0c4b799d", "value": "196608:oyvx4NMtOqmvvuWq39BN3+5mee5PcYnMw04Zr8W004Gyd0ZOrWsrSM6xwHc:V6etYmWynLB0YnMw0wWGyd0iuNmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263523, "uuid": "573ef1d3-57a7-4259-b49c-5aaf3b7eae41", "value": 16218421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263523, "uuid": "524a777a-7f73-4063-8747-cd1042d0a8df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263523, "uuid": "7ead9a8b-089b-48dd-9527-9857b3a42106", "value": "com.filegoclean.phonecleaner_1.0.3.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd05327-7864-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783250894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250894, "uuid": "b4fa77e7-fba4-42fb-a4a6-b7156bc7df0a", "comment": "Malware payload (Vidar)", "value": "b21ab5fec4f4792fc543fe66ba7aca76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250894, "uuid": "7541b24a-6212-4c43-a7ca-81cd95fef35c", "comment": "Malware payload (Vidar)", "value": "b4132ade3a61842f043b9bafc6aa6a874efd20c93b5266ab611f5d31dc783037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250894, "uuid": "9d9ad046-8023-4899-99b6-0b360517a723", "comment": "Malware payload (Vidar)", "value": "af021506ffd78a1d60cfac43e1e92d2d76fb3513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250894, "uuid": "d06283fc-58c9-492d-a3c5-9723b7bf84c7", "comment": "Malware payload (Vidar)", "value": "f5d52a8216912204597736167aa189752780d743953f4717fe05914ea687ba44be472ccff62902cf77a49bb08914d6ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250894, "uuid": "d6cc8ca2-267a-4d53-9557-9245080d1f6c", "value": "T1B3C36C597783E0B2E44D2375627E377DCEB09E353C90CA6BDF803D0A9E2A190535A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250894, "uuid": "a16b3baf-3f95-4d3b-9bff-a703a6e82bd9", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250894, "uuid": "451ff902-073d-4266-903f-4586cabf6c61", "value": "3072:iEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfavXU:h3h0aMJ+Hw3Pgen79/Svk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783250894, "uuid": "462c961e-28a3-4dbf-a8c5-6436eb476e71", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783250894, "uuid": "1d72a29a-15a1-4223-af64-4d1d55088bf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250894, "uuid": "c7cca499-3d6b-49f6-bb9a-e2b6a33bbb36", "value": "b4132ade3a61842f043b9bafc6aa6a874efd20c93b5266ab611f5d31dc783037.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320cc830-78a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783278203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278203, "uuid": "cf192b15-e7c3-460a-9770-3c52751f8915", "comment": "Malware payload", "value": "0b90ef2ce92e97e7b7ab1ad3c3e31498", "object_relation": "md5", "Tag": [ { "name": "Caynamer", "colour": "#0A764F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278203, "uuid": "39e74523-6f5e-4b73-bb19-6d147e3ee2f1", "comment": "Malware payload", "value": "b657a1cb182624c431b6836931ecb44de97f785bb1a99190d60628df996c109a", "object_relation": "sha256", "Tag": [ { "name": "Caynamer", "colour": "#0A764F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278203, "uuid": "b8943543-bac2-4ce8-bf37-583f13d1f7da", "comment": "Malware payload", "value": "3b155f07fd0d05911753932e9c7bb496be8013ef", "object_relation": "sha1", "Tag": [ { "name": "Caynamer", "colour": "#0A764F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278203, "uuid": "d7607377-a393-4c34-85d1-92f04db0714c", "comment": "Malware payload", "value": "7c97c17b0f8c25dae0b47f35fd3b0c7cfae44e7362fd84faafa6a487d2114db4ae6d1e325204ef25f5dbd80313a73f81", "object_relation": "sha3-384", "Tag": [ { "name": "Caynamer", "colour": "#0A764F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "luckyware", "colour": "#7632C2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278203, "uuid": "7ef3d00e-44d6-4cbf-97b3-3d9b9f053b29", "value": "T1BF042A35DAA9A07ED36AD878CD060D84DB62BC894790BFCB57D11DEA0F936C01F2D642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278203, "uuid": "e894e5ae-7806-4d59-bbca-251fda1b35b8", "value": "de3e74bfd953870246567b962b98e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278203, "uuid": "d54745b6-c2ae-401e-9252-639927fb2c3c", "value": "1536:SIyfiTOpZNiMMuw7Z6NDzPNTIhY5+ZySczk5Psru6LR:6fLwKznPNISyySczk5Eru6LR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278203, "uuid": "27ca4bc1-b392-4835-ac0d-3b3bb00dffa3", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278203, "uuid": "943c02f0-5e24-4e49-bcd1-8ede2ce8d0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278203, "uuid": "c16e1399-2aca-47f5-86ea-9b23526ba85d", "value": "OX_1781894260616.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72df849-780b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783212686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212686, "uuid": "faceb30b-ea2a-4402-8bb6-2a72d9228e9f", "comment": "Malware payload (Mirai)", "value": "a4ea7c23112be168a7783fa48934ec03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212686, "uuid": "f35aea8c-e8f6-48bc-abff-58bd66d6a046", "comment": "Malware payload (Mirai)", "value": "b74f6ba6f0a2fd9969cea27d371567823fd7b9a6ffe14aa5347adc63d70fc1e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212686, "uuid": "d6283901-f590-43e9-bd3d-5c716f990e80", "comment": "Malware payload (Mirai)", "value": "6fbb277168511b63056d2b813e50aca018a24e5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212686, "uuid": "36af55bf-6042-4327-a268-8d16b3ac3058", "comment": "Malware payload (Mirai)", "value": "2c2ccb82b72aabc877ffd22078c10258e6e983f4f35e561b13be8f12996811950e5b77f669ead88850f6d0c72f35952a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212686, "uuid": "bfe83470-5b4e-4145-a468-eb563bb50957", "value": "T11634F80AAB610EFBECAFCD3701E90B0524CC645622A53F367674D918F94A54F4AE3D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212686, "uuid": "356b078c-15c6-415f-ae56-c7e6b5109f22", "value": "3072:O/k9Epohhkm43gXAy6XboWgXGXzgR9foPGAfHBr:Hr4XwROoWXwW+AB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783212686, "uuid": "f4ddda1e-fc90-4f0e-9db5-0d2ae0af8954", "value": 246740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783212686, "uuid": "31c306f7-3f6c-4cdc-9ffb-94941ada32eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212686, "uuid": "2f7dc601-7b7b-4b11-bdc8-c00a240d2eb9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5f37f4-785f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783248909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248909, "uuid": "0592db9a-0abe-4f62-bc77-5a1e87346621", "comment": "Malware payload", "value": "4f382d162f76804a3f36399f0a30437f", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248909, "uuid": "aaebf616-801f-4324-9f0f-8696d5837baf", "comment": "Malware payload", "value": "b866b5fc9bfbea1f591f5f0e79be3f43d8ea2b119be940d6dc190a440072f1ef", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248909, "uuid": "ba32eb6c-e9ea-4f5c-802c-80c2d64a3e66", "comment": "Malware payload", "value": "c5875a1e2b3b6fb8eaff12fbdf05cad286429ebb", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248909, "uuid": "c7a28b7e-d9ed-4379-a7ff-91b0b6d979ad", "comment": "Malware payload", "value": "2ad9b14bcda4d9a7db754fa85d8372c55583134b647c32b02864d72e1c113f0240638e3c024223cec2d7d0aeb0d8e448", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248909, "uuid": "98522495-05a3-4928-a13e-e7e307629f4f", "value": "T114228DA9C348611EFE0698B9586C66739D73F2A101341F0E34566AE6390B445FDA53EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248909, "uuid": "b2d0964c-57eb-4101-933a-7cffc529c8f8", "value": "192:EGyo8hqVOeHryss0AAsjZnsxTeDPtZgF/ll1IFIM:EjthqVbHtsssjZnsxaDPtCF/llGFIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783248909, "uuid": "800c2fcf-2d5a-45f5-a851-c33205f1623a", "value": 10802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783248909, "uuid": "9d5a8501-088a-4e10-8d78-b26594f87fc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248909, "uuid": "89f01312-8ca7-4c83-b864-f54cef38f81e", "value": "sexy.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb2d263-7853-11f1-ac1e-42010a9c0009", "comment": "Malware payload (EternalRocks)", "timestamp": 1783243645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243645, "uuid": "3c291412-0b6f-4d39-9928-6b9591c10a8a", "comment": "Malware payload (EternalRocks)", "value": "c120a6ebac4cc908057922f1c1cabc68", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243645, "uuid": "12195268-5bf9-46c6-8ce0-84bcf63777fa", "comment": "Malware payload (EternalRocks)", "value": "ba8163e2256d9feec983aa780ee262d4b4d5dbe07790070ce8c9899389491cf7", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243645, "uuid": "4bba8f37-0ec1-462e-8241-05ebd449e66c", "comment": "Malware payload (EternalRocks)", "value": "b5a49e49a76f3fd9fd88aa2213b89d448907bdcf", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783243645, "uuid": "9ee8c29d-857e-4578-ae18-a32268168697", "comment": "Malware payload (EternalRocks)", "value": "91334ae072cbab2e438ff17fd3f52fc98d3c56237594d627729bd45cce72dc2cfb98bffdd9b0d4c93ede682e3d2cb8b7", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243645, "uuid": "4f0c732c-0f78-4272-8d5c-8c6613e90db0", "value": "T14B083378A4990D75D5B9563FCA3B993823213F319BE2506B4661F2062CFF0E05BF2E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243645, "uuid": "f2480c2c-0128-424b-9c23-945d8a89bbbe", "value": "1572864:K9DTAlFH3/HJC6HWgwNpgReoq765aOWRnxd4C9WzAQKe8FL7LeiJqsKmYMo8DUjx:AnO/I5DgRe9765a/N/QAQKDnapsurTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783243645, "uuid": "cb1d2f1e-3da3-462b-b1f6-8bc90ff4f6bf", "value": 78671343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783243645, "uuid": "8d1fa1c2-73b8-4151-acbf-b13241ac3b92", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783243645, "uuid": "fcefcdd6-430e-4ef5-932f-7187ffcfe011", "value": "Microsoft-Activation-Scripts.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3aaf1d-784f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783241958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241958, "uuid": "af9ba335-c852-49a1-bcf0-59d5c4b0b45a", "comment": "Malware payload", "value": "c6ce9f070d2045d6477455750d51de22", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241958, "uuid": "63adc68e-9982-4db1-bb86-450af201a529", "comment": "Malware payload", "value": "bcf6919c62267e25e8c026f28fd565f085d2ae3157097ccb2575888c6236a3f9", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241958, "uuid": "13c1f37f-af9b-4e36-9141-4f17fb774f2d", "comment": "Malware payload", "value": "2078fe21384fe93d1bf8b82ebd731a7af4158b97", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783241958, "uuid": "e83438e6-b85f-4843-9740-ea459451f629", "comment": "Malware payload", "value": "74b2c32bf30ba8b17a0539f5283f5de21504730f9fd20f8f9b44106882fe9a5f5dda37e00d13b8890d6dc60b4501b6ec", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241958, "uuid": "09951dfa-4304-4058-9e92-969d533cc284", "value": "T1EC08331C74235A26C09B5CBA8D035811E6086F572F681D5FA7BCDA63B8E57C009B63BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241958, "uuid": "bdfeaf67-b734-43ae-907d-88deed52f51a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241958, "uuid": "73abf489-aec6-49fc-baa2-799cb705a178", "value": "1572864:Xt9IKPP9o9RWYrLoJlb8wFoykhg4ngH8etzQ7:XUKHO9RWQyR8VPXA8eJQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783241958, "uuid": "ef9962f9-b1a9-468e-9d7e-db63a4054fab", "value": 77777092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783241958, "uuid": "34c703d1-5d20-46e6-a0d6-113594b70a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783241958, "uuid": "260f00e5-c5ec-46f6-9202-e09b693e5284", "value": "krnl-pc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2569b32-7891-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783270338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783270338, "uuid": "19e094bc-8141-4148-9fcb-b2941a3329af", "comment": "Malware payload", "value": "230d24b36c26154edc939b633d082679", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783270338, "uuid": "45470e9d-d1c8-48ec-9125-78de86d54dc2", "comment": "Malware payload", "value": "bd065af0ac3a048d71e215d527ddb23adbff8aceba95f57cc773877213f70f55", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783270338, "uuid": "65f8decc-7612-4d2d-8302-975eecae3968", "comment": "Malware payload", "value": "323ad0cb1beb1c75acb0c4cabbec825f287a4da7", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783270338, "uuid": "22e7d5b9-a836-45e6-917d-1a207db0f6f2", "comment": "Malware payload", "value": "f6858f2997da4adf34721584b684f74603131e5e98a3624495fa5e37b072115a34d6c91f52cb0ec4a7fd35fbe93bccf2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783270338, "uuid": "894bee46-a38d-442b-8382-ee0e8e98d412", "value": "T1B3E6330C45F012FAD1B3D03DDDA16AD5C4B4787A53B1C6CF47E4AA96AE930E08A3E653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783270338, "uuid": "311ef00d-c483-444b-9d4f-5cd91a94a4ea", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783270338, "uuid": "49377995-7990-4422-bc97-356a694b4080", "value": "393216:F0OSJGCEIbltiYpqdvG6WsXMCHWUjXgcuI3/PGTAI:FvNCEsloaabXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783270338, "uuid": "0cddc4db-b93c-4705-bb1c-69fbaf287d0a", "value": 14297664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783270338, "uuid": "a01b9bf5-03f2-4a64-b272-36c735d28cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783270338, "uuid": "5d4a8d2f-f999-4516-949a-62c451c44e11", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0821ca-7845-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783237575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237575, "uuid": "4652146d-9c1d-4593-a709-edcfd43cf7b7", "comment": "Malware payload (Mirai)", "value": "6f0856d8a8d077a853f60ec5e86e3866", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237575, "uuid": "63a13701-8903-42f5-a0ac-785545c60dde", "comment": "Malware payload (Mirai)", "value": "be730c016aec4cf4423f2f5caccac2b83f5c326a516103f9a0311d000a0a3fad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237575, "uuid": "7882f00b-1272-4554-8276-292757d7751c", "comment": "Malware payload (Mirai)", "value": "e7e671d5e150a946188cbb9d8df3f83023a9ae87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237575, "uuid": "fbd82d4f-a058-4e26-a8e3-bf74f3161a01", "comment": "Malware payload (Mirai)", "value": "d994020ad0f7fb9b56725e6f33140004cb9e9da25c6bf099282c45171f4b4cdb211876309a83e5990e9d429e0278873f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237575, "uuid": "51428419-072f-4bad-b699-bad806a2bff3", "value": "T1DFD42855F8809F61C6C539B6F74D42A873174B79D3EB72069A254B303BEB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237575, "uuid": "194ec88d-d729-4819-b7dc-00e77710c258", "value": "12288:dyMv4waJPzkL9BL/YUT/CY6EYPr4UQcfZREUL8pvuCjK:Bv4waVkPrYK/CYlYPrVQoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783237575, "uuid": "0eab01af-2b2b-48d1-85e3-0b2584d56da8", "value": 600392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783237575, "uuid": "729f49be-2e63-448c-87ab-5eb2c826df9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237575, "uuid": "e862e4c5-1cd1-4eae-9629-633c69dfcde2", "value": "be730c016aec4cf4423f2f5caccac2b83f5c326a516103f9a0311d000a0a3fad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02999b2-783d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783234257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234257, "uuid": "c93c1d24-2698-413e-8af3-0f5a43889b0d", "comment": "Malware payload", "value": "ce4adafd20398d18a0d79b2221721b06", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234257, "uuid": "f5e4263b-5307-432b-93e2-0010bba877dc", "comment": "Malware payload", "value": "be84871cb5b90a6a1b81ab50b8d557c7971fdfa4a1d4d94925c2ba740b30a6b3", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234257, "uuid": "056b45e4-8aed-42a1-9076-c25f853d01dd", "comment": "Malware payload", "value": "ea87f545d5636e149ad68dcf965295bc260f0c78", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783234257, "uuid": "52e3a9b3-29f4-4a7e-b26b-dc0b9968c9fd", "comment": "Malware payload", "value": "54329503ea3c7615f53fd9ffc5d7e4b8e914c2dc18f7d0867cf314d788ed3b0256d2b51eaf1dbdd0f8cd1f9368a05671", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234257, "uuid": "81211679-7eec-48ff-bf07-46fe5df0cf31", "value": "T1D601F4DCE1A9AF510AF9C586F5F14509C48190C7A1F757CAF28E0A2AEF6895A386320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234257, "uuid": "bab7a62e-b011-493e-89d3-6098169202c6", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+QDjfCuQxhjZhG+E6:FH8j/wWi2jz8XfTqh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783234257, "uuid": "1bd89174-3bde-4790-a42d-d243abc6a762", "value": 689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783234257, "uuid": "5dcbc969-51c3-4748-8849-018cf764161d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783234257, "uuid": "4346d5d0-2f21-478e-b998-55289b200c57", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fab486-7816-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1783217385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217385, "uuid": "7f383f9d-6c55-482c-bd07-0e5c136719cc", "comment": "Malware payload (Gafgyt)", "value": "46505a7f012438e9cd7cb8af114530ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217385, "uuid": "8ebc6a80-3b8f-41ed-b7b7-c235c51c1bde", "comment": "Malware payload (Gafgyt)", "value": "befaa63b031753c4e811f7f24b68c6107c8a6b1720e027aee673efde3c9f13ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217385, "uuid": "d66bbb23-ed4a-4fed-bc5a-aa4f32a36203", "comment": "Malware payload (Gafgyt)", "value": "0afdd25eea1c82c4fd134a5c914769d20f86b5b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783217385, "uuid": "8989de26-c78a-4fd5-95d5-9fb917d8b296", "comment": "Malware payload (Gafgyt)", "value": "22e2ce5564c1fd51fc4f84b29d2a089b7ae009d07aa59825a2059a764df6cd079ca392ceb87579c07365ad2433c56760", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217385, "uuid": "643d49c4-75b8-480a-b1c4-0be4c4ad1ad3", "value": "T1C744C71A3A11DFBFF56D863107B38A3047D9769626E1934AF25CD71C1E2028E681FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217385, "uuid": "1ca5a631-7398-4774-a327-4198eef3de23", "value": "3072:dNFNVpJHJ4vqUagT10PJCRZUSlY9E+YlyrbT+Zy7KwmtwAL4OObI:FXGEgCPJaZdd+nbT+Zy7KwmtwAL4OObI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783217385, "uuid": "59dbf4d0-3320-47db-98aa-6fe9b1c494a4", "value": 253365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783217385, "uuid": "cb1afe14-ef04-4e03-8895-ac4379b6318f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783217385, "uuid": "818e7483-834a-44fc-bf26-c4a2dd385649", "value": "befaa63b031753c4e811f7f24b68c6107c8a6b1720e027aee673efde3c9f13ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef175a5-781c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1783220001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220001, "uuid": "c4763913-bc99-4405-a260-5d31762e7557", "comment": "Malware payload (ACRStealer)", "value": "e1824c5e2e9ade06e617a7e061fc8633", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220001, "uuid": "357c7e3c-939e-4ef3-9a98-cb6888809e7d", "comment": "Malware payload (ACRStealer)", "value": "c016fd7194859f518e61b204e9df51a683959a28399bd88ec0f7b7f30858f133", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220001, "uuid": "af8a253f-9a36-4d2f-b98a-1802796ca782", "comment": "Malware payload (ACRStealer)", "value": "b0f7017a9b3ddbd3c9caaecfb19a18c18f628465", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783220001, "uuid": "02e77c10-b5d3-4f9d-8de6-154998090772", "comment": "Malware payload (ACRStealer)", "value": "49e928c04ae8349e7100ac34a022c3ccbd0704a8961508ae7020518a22acd4eee207e7933d2d32a0656a24fa6113f89d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "push-telemetryportal-cc", "colour": "#CAB996", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220001, "uuid": "e035f5b9-b108-4446-8ac8-bce17eafd0aa", "value": "T1F57723697A2D340BF9D18BFD94E539CC2167258849912E2F9F2F4471F673319BC3A822", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220001, "uuid": "dc9a8614-7d9d-4764-815b-fd192c564391", "value": "786432:eak7U8EBheCm/Pk+fDInMSnAZolgT9Tlltn2Fk8jB:eaQEBheCm/8eMhnAWlghLtn2F1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783220001, "uuid": "96e6360a-5ac2-4a1d-a0b6-d9eed16f3e78", "value": 35218129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783220001, "uuid": "f9e7481b-c74c-486f-a777-54be0d529743", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783220001, "uuid": "8f813503-33c2-4071-8cfd-dacfdccf7099", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473cdbe3-78af-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783282963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282963, "uuid": "e2541685-054e-4ee3-a230-775395b5e88b", "comment": "Malware payload (Mirai)", "value": "b230e3e462e20ea5a43b3fc97fcddb0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282963, "uuid": "69504f58-4db1-4cad-9c91-574672726618", "comment": "Malware payload (Mirai)", "value": "c18aebf9c041c7f430259e590e4bfd921ad5d4fd641bad51132f7b64823b36f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282963, "uuid": "e617575e-0f5c-4e68-b555-fe2403e91ec1", "comment": "Malware payload (Mirai)", "value": "d33f41bbb3d5cbfe68516e1ed739f697bdd62e78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783282963, "uuid": "e15230a9-b640-47f2-a609-85103985774d", "comment": "Malware payload (Mirai)", "value": "fc16f79890fc2e66080a5f4e8907009f69f2ef8d832800ebc1fa3c0609f0b653c9441260a8d2b818734f815d37a1f5f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282963, "uuid": "0c867e64-c9f2-4c19-88fa-cb4587ee4412", "value": "T131B32A99F490DE62C6D4267AFA5E218D33134774C2DA32068D149F3137EB9DA0B7FA06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282963, "uuid": "c4283a55-784c-4047-8280-22f26bdff4d6", "value": "1536:EZ+7WhcYRDB3wjvlVfpVPUIwj/aY3Q0KF3+ukcOcKzmNO1szl+FqUs+KPVzDr2Gd:NAcCubX2jSYZKgRdmfruK9zD5Ty/XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783282963, "uuid": "0a914058-e83e-4611-b684-f15e9a1142d0", "value": 108076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783282963, "uuid": "124e4dfc-a947-4d85-b791-9b9255d33dff", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783282963, "uuid": "28849816-b84c-41b8-b4bd-f3849af1e75d", "value": "ohshit.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba95a8a-7856-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783244933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244933, "uuid": "d92fd963-6a00-4e73-885e-0458d5941cd6", "comment": "Malware payload", "value": "905ae782ba00fbde2963dec755f5d044", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244933, "uuid": "2b28c493-a28e-44eb-9e00-7407ea445d9a", "comment": "Malware payload", "value": "c1ea20fd5f329bf2b54eb7c0f97aaa424d191fe545f334495b1087e69516684d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244933, "uuid": "e1802881-8d19-47cb-9002-cfae557847c2", "comment": "Malware payload", "value": "a9e3841eda81d00ab7691956636dda8b17033795", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783244933, "uuid": "11dda6b6-5cc1-437c-af4d-f2e91e41332c", "comment": "Malware payload", "value": "4df06e782da88168024047dc8117d8439a7e4acd7e053e05284319d3cf020105683f343057843d27f9e78207368e37a3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244933, "uuid": "550e2432-5108-475a-b190-3d593d7c6b91", "value": "T12BA44C94B784FDF6EC894B7408D21309A369F0C1971AEF2F2524FE3C095AB98DD6354A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244933, "uuid": "50e6423e-03c9-432a-90a1-9c5bc43e7e81", "value": "c095785504362cd51bd1402c51942181", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244933, "uuid": "672680bd-a094-4bc2-8740-dcf0761cb624", "value": "6144:0l1JQtOmABS+4Knkd2Ruj25KVuAiE8HyiivHUYk6qSTDs+l8mogOKTiQZiruAP:0l1WtV3skgIa4sotPxBDXVBXAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783244933, "uuid": "23f834b7-e0e6-442e-93a1-e2032313d035", "value": 481715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783244933, "uuid": "85491503-cd88-4f7e-8b1b-d5c74d1b0c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783244933, "uuid": "27aa577e-6544-43c7-b811-50869e1dcd99", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71acf32-785c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783247529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "0ddbbf13-1de0-4574-9b75-ca92e5764831", "comment": "Malware payload", "value": "008fe947c1633615a316297a4d5fc1b5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "db28f5c0-e459-4e12-a2d5-c1716713297d", "comment": "Malware payload", "value": "c264f10e4e3bd99c5d46510cbd65027cc0932ab9ef5a899f541d7ab12830e02c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "8684f036-872b-4a21-a9f7-15214af920e2", "comment": "Malware payload", "value": "fa699e77d2868ee7f2fd9c8962da87a9bbd87000", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783247529, "uuid": "f7e15c4f-d2ef-4a81-b436-c987801d1471", "comment": "Malware payload", "value": "30dff971c074502665cba5c5a2553ee2f82e684d5730b17a5526e6c1159dd0dc4be5488aabc388e9aa64e1ced48623dd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "66f85a9f-eb1f-4d1e-af37-2393eab17d06", "value": "T1AA21FB3155341803FD6B812D5045F921D1D7F735ECF4708A59562FE300B54D682A1714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "f860367c-61cc-49b0-bdc9-d39e5a7d5769", "value": "24:MptT95bQwJv9FLLd1PGS41wBNss7DPqLprYh0onhIeTwJZFzOCcUbv:yLJbLdF0Ms+Es7hAFjcUL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783247529, "uuid": "a2c29533-6d3f-43c6-b1b5-d4621d9e7e1f", "value": 1297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783247529, "uuid": "a279bab2-7c33-4f3f-8b9b-62f4fc7cea16", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783247529, "uuid": "52f3bec5-ca9e-4e9a-9377-03d2ccd122ae", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78503454-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209601, "uuid": "d714cf7d-7e6d-46e9-88fd-31ca8bef90b7", "comment": "Malware payload (Vidar)", "value": "cb6189c15ec116abb50005041e178d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209601, "uuid": "e451ff45-63c9-47c9-8f9a-64c2a95012ce", "comment": "Malware payload (Vidar)", "value": "c2cfd3d5cc6db52356661d50b0374c494c96af73cb0fea33babb9616d4453098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209601, "uuid": "a78bfa4c-ff13-4c21-a6d0-998c51da8d9c", "comment": "Malware payload (Vidar)", "value": "6995d6a1f44b8ba4f5c9971514e082816a8f0eae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209601, "uuid": "91a1a7c6-2a7e-4a53-9964-1c7b0d004496", "comment": "Malware payload (Vidar)", "value": "98a491131663641a81e125d5ef8d15635b9c93e16e6ce212fa7b9c485d7d117e2cdc6ae8958e77b5f944169715588823", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209601, "uuid": "0571e328-65d8-4622-831b-38ffcb3d95f3", "value": "T169D59C0B6CD049EAC4AAA63689B751927B30BC054F3263D72E40B7783FB2BD09D75B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209601, "uuid": "65529381-26c6-4f37-b66d-11df27ae0cb3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209601, "uuid": "b142ccdc-8d36-4bfe-8cad-226ad962d783", "value": "49152:nwIjnR4toOc+w1uxYOl+FGVrNPflR16x+g2:nwu7syFGVrNVR16kp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209601, "uuid": "c52ec881-2c94-452c-b857-d9dcd955e8ea", "value": 3009912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209601, "uuid": "b9c84b90-12c0-4858-ba03-d8dc047a01ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209601, "uuid": "2b69bc14-a25a-405e-9dbe-85523d763529", "value": "SecuriteInfo.com.Win64.Evo-gen.88959866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb817da-7859-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783246280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246280, "uuid": "9b60f2c9-9d36-4dec-b09b-e42127f1e47e", "comment": "Malware payload", "value": "cd2d616c9fd17fd1dbf2857006cc643a", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246280, "uuid": "92d96b70-c66b-47f3-9267-43520e185e11", "comment": "Malware payload", "value": "c3b3c92fbde392fe872dc980dfd9b44e7754af2a36fa4f4c3ce8177f763c275a", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246280, "uuid": "cfe0554c-b046-4c00-9cab-a5f4e37552ec", "comment": "Malware payload", "value": "764ff313855a39d537f599189be3fdb9bf420b37", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783246280, "uuid": "46574745-f94a-4f87-8a75-458b2cc92a7a", "comment": "Malware payload", "value": "f6d4a1b681265567851ee6d00af2c36d9d8716c973a1fdb7d6aa25c13602bb12b6abfe8622cf69f5b386b5606f3d6af9", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246280, "uuid": "205d7d37-367b-47af-9fd2-6c4174a13005", "value": "T146187D03F2A341D9C06AC17587D6A233F671BC0A5B34A6DB368C4B222F76BE05B39755", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246280, "uuid": "2da9fef5-09f7-4de1-9d05-4c19543afe19", "value": "fee2d6808999044373ca2120a0122d0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246280, "uuid": "a56a5b18-be69-428c-92f3-45894ef74a9b", "value": "393216:pA8R+jJqy2uq3xv7KstO9oCFsqdOrjaj+XvfF42a0ZvMZKfRO13bzwXls8vrnqwS:pA8R+jlnCK0lCFsTpTNvHBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783246280, "uuid": "24d31cd9-97f5-4b50-a726-d27c8e452729", "value": 88259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783246280, "uuid": "c75116ac-0503-4193-b761-4a345d2a6e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783246280, "uuid": "d218c138-1466-4d3b-9af7-e9f0570db3e4", "value": "KMSAuto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59419eb-784b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783240198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240198, "uuid": "84f391b2-0064-4714-bce6-3858c3b91649", "comment": "Malware payload (Mirai)", "value": "c1d4a6957cbe5eb202675c6702997ef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240198, "uuid": "62d41c1c-d56c-4849-a93c-f2e375d83cc7", "comment": "Malware payload (Mirai)", "value": "c47cd28e05f0c2a1f6276f244d2b17b9ddc25fcbeb11839090313dde2160cb70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240198, "uuid": "2df58a28-6491-4a10-b174-37f8f238b2e0", "comment": "Malware payload (Mirai)", "value": "27ecd88e541d1b175da5369f106d7fc964a8ae2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240198, "uuid": "3a5f0c63-6bff-4f3f-b440-aff501166137", "comment": "Malware payload (Mirai)", "value": "1c52d2d140155d3a92f91e9438af60259a159dca27b958e0a0005876d55c34fbc736c6333bbb498fcca07a4026968d95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240198, "uuid": "5ed7fcf3-7c1b-4860-bf06-ed8b359efe04", "value": "T106E33982B9C25A23C5D523BFFA6E418D3325A3E4D2DE710798635F2037C691B0E77A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240198, "uuid": "470c8638-c4fc-4c70-9248-ff060ab4276a", "value": "3072:QrayhqI0RBWsrLSnpJktYs66cVKDQ4AsnniM:QrayCdnSpStYs66gx4DniM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783240198, "uuid": "aaa76ff4-43a1-405b-8d3c-e201970167cd", "value": 148948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783240198, "uuid": "384c1be2-5468-4748-b8bd-edba85b03e6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240198, "uuid": "3d4dba32-2412-41fc-9e48-62644d8c87e6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359821ac-7863-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783250292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250292, "uuid": "b322728b-bc71-432e-a681-1eb72b2682cb", "comment": "Malware payload (Vidar)", "value": "1597875cfe462a164c7f4e8af0c36601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250292, "uuid": "6a5cae8f-ef01-43b8-aba8-295dcf641286", "comment": "Malware payload (Vidar)", "value": "c7195e19685ed252be9d105f817a31a475430e76c9beec4cc76d3377f784a21b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250292, "uuid": "8810fe15-5d53-46ec-9bf8-b6a966f5c836", "comment": "Malware payload (Vidar)", "value": "ec86b17c5678a80c2aeef5cb4df4fa5fc66ff72b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250292, "uuid": "3321345c-3b92-48dc-beab-431f18c19077", "comment": "Malware payload (Vidar)", "value": "bdaf277f3c9776b751df2fc2d3abdd1c96bd5bd5267b90967ba41c438db6215b52037a0d41140c46af1333c94689ad59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250292, "uuid": "4ee5eb78-16a4-40fd-9cd5-94e5c0a115e3", "value": "T1F4C37D5A7743E0B2E44D2374627E377DCEB09E353CA0CA6BDF803D0A9E29190575A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250292, "uuid": "11f655df-e204-474a-a739-64830206983f", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250292, "uuid": "504368ba-74c6-4dfd-abd6-b1b7729f4a26", "value": "3072:6EFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfavXUk:J3h0aMJ+Hw3Pgen79/Svk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783250292, "uuid": "775ca468-1f45-44ea-8a4f-0f731385adcd", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783250292, "uuid": "992f8d40-990b-43b1-bed5-613cc8b32b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250292, "uuid": "c47172a7-e39c-4264-a4ec-4a9f87bbd26f", "value": "c7195e19685ed252be9d105f817a31a475430e76c9beec4cc76d3377f784a21b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56c10a9-784c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783240708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240708, "uuid": "1c9037b5-8888-4608-bfb5-526f51a9ed09", "comment": "Malware payload", "value": "b722737394c97244372da91139e35e9e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240708, "uuid": "d478359d-1d7b-4799-870d-52a729ddbf1d", "comment": "Malware payload", "value": "c73b6080ff81a42336be2baa3a159f746a054032615f53d0e1ff56d57c357b14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240708, "uuid": "d9ef92bb-afb2-44ff-ac68-024ac7c5d202", "comment": "Malware payload", "value": "6700459d4a22469c72e22a302fad21549050f859", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783240708, "uuid": "2c791718-7fd1-4104-ad43-ccb8b1b34a4d", "comment": "Malware payload", "value": "18e0767054c04a96684a35725d5fb473bcd46f826dd472b1593b5df87cc1c3890a7b6776597d0fc40cfa010c29a47780", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "rugmi", "colour": "#64B88F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240708, "uuid": "17e269f9-3368-40da-aeff-421882ae0f39", "value": "T171565B21D302A22AFCF381B6C9BE525E5124AF31171145DFA2CC3E4E9BB95E17E3251B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240708, "uuid": "15cfded9-1f3c-4adc-b730-ecf80c522559", "value": "1207a47bae531da7d722a4313dac28d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240708, "uuid": "5920b182-6f6e-459a-bf44-8daf4ce402bb", "value": "98304:jz3xiYz5/dBFG7dCcOJKJYeJ1Z1PJsv6tWKFdu9CHDkkh:jz3kYzl3FGpCcqKJ5JxJsv6tWKFdu9CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783240708, "uuid": "a0dca08c-64eb-4c12-b6f6-16bc5c1ee438", "value": 6055488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783240708, "uuid": "4722a809-c511-4052-8519-298061cc24fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783240708, "uuid": "20c8ce4d-8f3d-47c2-a979-1dd7e4d85650", "value": "Qt5Core.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a779096-7851-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783242649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242649, "uuid": "d3d6daa8-d047-4c85-bff0-43916d58764e", "comment": "Malware payload", "value": "6a4afcfdccba033b519a97d120660334", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242649, "uuid": "fdbd3ff0-dedf-4bc2-9f6b-a8db96304efe", "comment": "Malware payload", "value": "c77be4d8c811de55eba0aec3442e770f6ceea915059eb38129a1bb0f0f9fc182", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242649, "uuid": "3d8e7933-36c9-4b88-a3bf-4a8ccc1cf73e", "comment": "Malware payload", "value": "cdd3d7899b56f6b1e960978afa2e3e41f2738831", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242649, "uuid": "0d7488c7-89e7-4199-90dd-725485d3edc9", "comment": "Malware payload", "value": "a2d66901e0e030c52c5dffd01013d55b1b362d255045ed981a11776e1250f8e874af9601cf82172f216b6356522474ae", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Yogi", "colour": "#54A406", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242649, "uuid": "cd9a0df9-6756-47ce-a079-0cda64985f5c", "value": "T1BBC39DD2AEC46D86ED62633832F596222B3DF9D08A12874F742856311F13BD07DED71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242649, "uuid": "58c6a76a-0c7a-4f93-a896-98e6bf5d29b6", "value": "c9de8759d85c8ed1f1deb14136eb8331", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242649, "uuid": "60f7ce34-ba1c-46ec-9699-f3644b9fc611", "value": "1536:0bKrNXlr9fAAdY8Eqz2qIXXXXXXXXXXXdr6XxvSP/XXXXXXXXXXXX5iZoPvL/TBA:0klEqzfi25SPxienLbjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242649, "uuid": "6fda9a76-461b-4068-9011-afa3ef3b3cfe", "value": 122208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242649, "uuid": "8db9a3e7-1104-4398-90b4-4f8ddc113cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242649, "uuid": "3b96f80f-9d7f-4619-92a5-1737ca58e69f", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57261e7f-7841-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783235745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235745, "uuid": "5be01f6b-323b-48eb-aef1-8fed2aa268fc", "comment": "Malware payload", "value": "22aff51a5377d275cbc0e34d613be9cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235745, "uuid": "2d8d2926-a6ff-4dbf-b903-9817a03114d5", "comment": "Malware payload", "value": "c7ec30029a10580a0b33b71b75d34efe053cc34d908bf75998f457a0c1f074f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235745, "uuid": "68ebffec-ea27-4d91-b10e-1eaba35b8f01", "comment": "Malware payload", "value": "5004f74c657579a47e23c86b9bf5eb29e3631cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235745, "uuid": "e645a369-8baa-4eb7-b857-b699f5363b97", "comment": "Malware payload", "value": "47fc4fe4c030c698c5b9474569d6eddb3d16d3d6ac2b6694fd3ac781bb0fe89cc26740989f983e2ec4e166c05ace491c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235745, "uuid": "78a801ba-0ffc-4065-893b-40bef8f57044", "value": "T10E735B51A245C2E8FA6658FCD964162BD3F0B0647B688BCF87A08D193F5B6F17D36380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235745, "uuid": "2cc9f0b6-4fbf-435c-b95f-e37e26fa5dbe", "value": "93aaf72477167a05c85c15e6440d1c06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235745, "uuid": "cc5bcee3-7911-4e1a-a3d6-ce92c98e9699", "value": "1536:3ahqaGNHCfsIQMaO6MuNH56JTAd7+EaDd:3aYad7+0bDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783235745, "uuid": "fa150915-5e26-42c4-aeab-a6a777ab7925", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783235745, "uuid": "10dd4ddf-5387-4462-9512-8550160d180f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235745, "uuid": "76647bf3-9b53-477f-a45a-5ff1ddfe9d66", "value": "c7ec30029a10580a0b33b71b75d34efe053cc34d908bf75998f457a0c1f074f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b5f8ad-78a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783278345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278345, "uuid": "fe8966a9-a900-4908-a7dc-35fa0e538865", "comment": "Malware payload", "value": "29887cbe17f388fa21f5ef299e675763", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278345, "uuid": "1c59ecfb-27bb-4741-84c5-2db99435f9c6", "comment": "Malware payload", "value": "c8ad210e5e8ed40333aee802f47572d77c290e891c0294e8f7a41e1ccc4c66c9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278345, "uuid": "e4d59c27-7d70-4f2a-becd-456476867305", "comment": "Malware payload", "value": "86a981329ca5b112d5a33f8fff0dd4dbc88a6c24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278345, "uuid": "3677f734-d375-47aa-a307-01dbed8744ff", "comment": "Malware payload", "value": "d23f919cd74c5b52d7dfeebf0e7da8d075f10ce404b7115e0dd78c811770b51f454a961b4ad17998a8f817766af7e2c0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278345, "uuid": "41dd5d3a-79ad-421f-bb8e-f2e87fb980a1", "value": "T13D137D6966857C24AE9988371C7E2F0CB9A983E1310451DDBFCB3CF58C49B9CE219B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278345, "uuid": "644c0fbd-4789-4d95-818f-d342c9100c5e", "value": "768:9+s9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:9+Bco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278345, "uuid": "5b8f80c4-544e-4371-a369-f3b1ae158898", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278345, "uuid": "f0902604-7f1b-4851-b65c-43c7c0fee691", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278345, "uuid": "9df66c3d-df38-4c93-919e-8f43d2655291", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50491e6-78a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783277537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277537, "uuid": "ec6c0bf2-bccf-403c-a5d2-c403cd7538e6", "comment": "Malware payload", "value": "cf49802b81b27e363e2d9bc67c238f4a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277537, "uuid": "fec91582-1e29-4ed7-8baa-13a24954fb8b", "comment": "Malware payload", "value": "c9a5e2967baa8cd313f6f069632aeeea9cf53af387cdd9269f591bde86abec2e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277537, "uuid": "02f7a9f4-8c51-4887-8ce5-f81164797b64", "comment": "Malware payload", "value": "50645511c07f1a4701a9258df7df446b80feb25e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277537, "uuid": "f93fff25-c195-466f-a5a9-b0958fb7f0a3", "comment": "Malware payload", "value": "4ca65a4fc9416b4f22033531720c2c58110acc0f22ddf5e92e5ed7681779e94bd17c20a32866a99717d709b4ee8964d9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277537, "uuid": "e84d188a-f518-4247-bfa1-f253997cdb50", "value": "T166E633485AD011FDFA73013EDEE1A2D1E550B8A25B32CAEB476057E1DE172E08E3D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277537, "uuid": "f2f51df3-ebca-405e-9c79-5e6f91b95135", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277537, "uuid": "3e189d0d-f1b0-4f6c-899c-eadc4aabc727", "value": "393216:a4zSQqCZVOrpwptkClIpXMCHWUjXbcuI3/PGTAI:aOqccrpwpTlgXMb8XYH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277537, "uuid": "7945431d-28dd-49fc-a361-5a8b0a9f9574", "value": 14322589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277537, "uuid": "092cab6a-cc4f-427a-a639-b25a08da799c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277537, "uuid": "e9170897-e812-4a4c-bb23-7faaa99902cb", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1603d6-7881-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263407, "uuid": "bb0942b9-d4f8-428f-bbc3-19eafb6a73fa", "comment": "Malware payload", "value": "b8811c68fb1b403a1d2d79e3459b4cd3", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263407, "uuid": "b2a5f15d-a4ad-4ba3-8fca-09e40fdaecc9", "comment": "Malware payload", "value": "ca5f124c63049e3a051a7f2b42933104c108421ce31b5de277859c6375c0d2b6", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263407, "uuid": "ce6f2450-e93d-407a-8f5c-b36bd3564e5b", "comment": "Malware payload", "value": "5a9a8d6ac1c2f9b43937f2384ec49ea283e8430b", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263407, "uuid": "23e860f3-3694-450f-9676-c523ee3d71bb", "comment": "Malware payload", "value": "afa7597bf85ed982c3c2f5c8358c2f4c9326ccd53c7ec4dc7cf8434ad833455e736e9de972a7578ffac09ecd462714e6", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263407, "uuid": "20917141-80d6-44cc-8729-721f3cfbeb80", "value": "T1EB27224FE72DE82FC8E6A17E88750222916368A18353E3D72E15B13DED976C45F25BC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263407, "uuid": "f938ae28-2b3d-483e-9fc9-5b67ddca5c10", "value": "393216:SPLgX4DXkY9umKeE7/NKqGjK9R7ro8EnBkC0t9JG0G5t9L3WL0LZGDLgvqJ:kL7z/9up7xGW9Jro3eC0rnYugQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263407, "uuid": "382eb0c2-a748-4100-8dee-000909f356c6", "value": 22132945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263407, "uuid": "74f30553-86cc-4ebc-8fa9-c7b6e768f1fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263407, "uuid": "d6b55edf-9704-4999-ab68-f12a5fab7558", "value": "com.minera.cleanquick_2.06.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c10661-7814-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783216330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783216330, "uuid": "70a47674-dae2-4e9e-847c-b72f11bdd4ed", "comment": "Malware payload (Efimer)", "value": "69ac856f989a3dc0d8bff532c6f7f331", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783216330, "uuid": "ad750aff-a80e-4cb1-9d3e-86579cefd1e8", "comment": "Malware payload (Efimer)", "value": "ccbf818a36523c19051d066f8e5edad655a478516afc916cd915aacca80dbcd2", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783216330, "uuid": "331e79c3-dda7-4b77-8784-6e5b55bb6c61", "comment": "Malware payload (Efimer)", "value": "a6b87c3a216ef6e26d483fa69151174b27a7c6f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783216330, "uuid": "11ce0118-a034-47ff-b0c3-e1c7bd257d2c", "comment": "Malware payload (Efimer)", "value": "4ca9e45a79b540a544f44c92096fa5cf077122ca2948cc3eb191af546914302fd36e0fb790ad65d65d7da7097fae6067", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783216330, "uuid": "5b2a06d2-3969-438a-bb44-c2051ba55b90", "value": "T1E0E633545AC001FEECB7513CBEE14695D5A8F4BA4733C5AB439CA3622D271F08E3A762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783216330, "uuid": "a571ba59-a3bf-4d6b-bc5c-51814e86f693", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783216330, "uuid": "e3643018-86e3-4ef0-ba48-c491ca5ac28e", "value": "393216:5PT923iF69GT0Y+XSDOhSXMCHWUjX+cuI3/PGTAI:5LkSg9GkaXMb8XzH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783216330, "uuid": "4b04afe1-91c9-455c-aef3-54f30e193b0c", "value": 14318015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783216330, "uuid": "210f819e-2268-4acc-8424-3bcc24d99f49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783216330, "uuid": "0a3973b9-bd63-4aca-9975-3c15652855a7", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b74c3f-780e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783214108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214108, "uuid": "6c83ee5b-31e6-4a64-bc66-431acc59ec80", "comment": "Malware payload (Mirai)", "value": "7feb34857e0f3ad6c939c0e9e7d4f65b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214108, "uuid": "d015a217-3fb7-498d-b1f6-b732661a2d7b", "comment": "Malware payload (Mirai)", "value": "d1bc8967a413300d080ab7720d597511c1885912f35f6b11e4462dc12eb314ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214108, "uuid": "4c45c745-4b47-437b-ae1c-fbd39730a932", "comment": "Malware payload (Mirai)", "value": "f2bea48e8eec792f90bba98e5f8e1852ed8fae77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783214108, "uuid": "b8a25bd8-a18b-4a96-a61b-1d5a7757faed", "comment": "Malware payload (Mirai)", "value": "222afa436d8a797f5004c261a4e33992728caa62b3cb192ed8357cda0e0df11156ea9476ab5871c7404c4e3b82b70927", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214108, "uuid": "fd968f47-da65-45b4-8505-d70e2b5ce4ad", "value": "T1F734C61F6F228F6EF269CB7447B74E35975C23D622E1D684D2ACD2101E6028E541FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214108, "uuid": "c060d1db-5e9b-405d-9d6d-5275e977b2cf", "value": "3072:jXzW5U6H5df8GyIzXBOud7stJMxJtnbCl6NGU47loJ2:jXSSG5dWIrI8xHbCl6IHloJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783214108, "uuid": "9908b63c-d4fa-44d1-a6ce-03e0c065c761", "value": 242740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783214108, "uuid": "88a7127e-88d2-46a6-903b-940e9f1a5dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783214108, "uuid": "ecf626c9-d385-4841-9b21-8b809e5740b8", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cc31a41-7881-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783263135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263135, "uuid": "50f2e754-4689-437d-8418-d7bd4a902b6f", "comment": "Malware payload", "value": "dce3d1235dd6f7fa5453553b32920eb7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263135, "uuid": "4e8c77e3-cb2b-42fd-8ec2-6b400211bba4", "comment": "Malware payload", "value": "d89886491caa9de5355fbafab79f89970e532f4e3cccd7e848f58573f844741e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263135, "uuid": "2a06d527-09a7-475a-935f-b349688f6677", "comment": "Malware payload", "value": "69eb7c874448afdd68f43a7a8186d6b486463d40", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783263135, "uuid": "de9bdee3-7a29-4e99-9636-b11c9c13b597", "comment": "Malware payload", "value": "61b5ea4e3f6597315e00857de313d7e4e0bb5aa2295245fd51ac28e86fde5df969e57cb1b702dfd0aaf69868a49675af", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263135, "uuid": "1628aa95-18c8-4208-ba4c-3c6a3392bb13", "value": "T197E6338859F011EED7734039FDE6869AE9BC74A60772C78F27D443625E532E1883E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263135, "uuid": "9dde96cf-7b61-4c74-982c-dccdd0bf9d3c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263135, "uuid": "0983f5ca-bd06-4a59-88df-d3b6519fd51a", "value": "393216:jm6OZuPQyCWpBBe5XMCHWUjXEcuI3/PGTAI:j/QyCWE5XMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783263135, "uuid": "08307526-af7e-4517-9249-3403a1b8121a", "value": 14327986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783263135, "uuid": "a05f9ece-907f-42a5-96ac-cf7cb590c007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783263135, "uuid": "8a55c352-4e69-42f5-999f-18e05124fce8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f4f9dc-7847-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783238218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238218, "uuid": "65ba7f78-a1b5-49e3-b088-eb516b766156", "comment": "Malware payload (Mirai)", "value": "7a30310d84fe99c5c9ba949e71d5cec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238218, "uuid": "f70628b7-8a94-459c-ab11-2e41befba245", "comment": "Malware payload (Mirai)", "value": "d909c5b0d2cd8c8207b3a83b6d7fdf7887ad9efe16386f947a0251ce6338074f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238218, "uuid": "ec463557-3045-4e94-9ee4-02905f517d01", "comment": "Malware payload (Mirai)", "value": "708b2c62f8efb5ca220a07457d3cabf3043194b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783238218, "uuid": "a16eb19e-5272-4afe-b771-8f4709fa1f32", "comment": "Malware payload (Mirai)", "value": "f73478005aa5226d5503dc87810573528ea3abbfa2e6c16947d33a5d758b82e611e7a5d25b89fb6999fc01f92b904fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238218, "uuid": "7511d0e0-6cb8-4169-ab6e-cea14b1f42f8", "value": "T160E3492274791A2BC4D6987E91F70B21F1F1D7D929A8D90E7EB20D4FEF202502713AB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238218, "uuid": "740a98ea-b6f1-4281-8f8c-98e5071c5c66", "value": "3072:MPXI8371j5SWNwhdg5Qk7NQX5qcXHqwAH309CryQl8x4bCfj:P8Jj5SWozk7kqNXYQmx4ufj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783238218, "uuid": "f844fd3f-1931-4ec4-80d0-29fcdddcbc7f", "value": 146048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783238218, "uuid": "15e4c9d1-5ec1-4f79-8fb6-e6cbcdb72092", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783238218, "uuid": "f4f06ad3-fbec-442f-9e90-256ecb5f42eb", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8946c144-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783209630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209630, "uuid": "b5d7a9d8-966a-4747-be4b-bb9536826097", "comment": "Malware payload (XWorm)", "value": "4b3c6ee4490da28af2ec40637384c400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209630, "uuid": "6e5fdd43-552b-4358-8aeb-db18eea05565", "comment": "Malware payload (XWorm)", "value": "d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209630, "uuid": "188f2249-c00e-4923-99d8-1c559220cc3e", "comment": "Malware payload (XWorm)", "value": "96f4bf9096686fcb2cd171034b9ea22cd4da2280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209630, "uuid": "240acaf6-7f5c-4c13-be16-ccabdedcf928", "comment": "Malware payload (XWorm)", "value": "e3325dd76e832e3dec5026332ef3715af650cde56455942e071317e8bf83433ca27773e873885dfbc432e50f29b104dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209630, "uuid": "8e51b653-9239-42ef-9306-303bb88d3110", "value": "T1F134086E9E97A641C5160836B87353814B799E7964CFB5628EE33FFE4BF3C9810070A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209630, "uuid": "4c11c11f-f62e-4a90-9e6e-9b6c18d73f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209630, "uuid": "0d5f7a91-0435-4ac7-b98c-f17c62be4be6", "value": "3072:4/sQH9nTmUMzavkcHrU2DYgdbIX5US94NpVq8BxFRzaqF+o2GQJ7/JzqVfGv1:49TsgYUbcdgVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209630, "uuid": "4e857c6e-0e1e-4c82-b135-44ceb0064c26", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209630, "uuid": "57d86698-cc4b-4b32-9043-3015e1d856fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209630, "uuid": "855db511-4136-4947-a55d-40e764983b3e", "value": "SecuriteInfo.com.Trojan.PWS.StealerNET.203.19366.4374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff48512-7824-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783223519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783223519, "uuid": "ba4a0ebd-69df-4450-9fd2-29c130bd948d", "comment": "Malware payload (Efimer)", "value": "ba3544437b369bbd4687a2ce30077a3f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783223519, "uuid": "eb191150-d530-4fc4-a6bd-db208c2d1f3a", "comment": "Malware payload (Efimer)", "value": "d9f15a43821328bf482e2945ff9da40fa05f382777819d8e9fa3aaae8704862d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783223519, "uuid": "1bd8745f-5d3c-422d-9a7d-05595a504023", "comment": "Malware payload (Efimer)", "value": "612fb6725b2c4b8f2c0edf6a2de5b1e53c8b8a76", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783223519, "uuid": "d6ed0275-3cae-4811-b9f0-618d4f7f639d", "comment": "Malware payload (Efimer)", "value": "0189377bf0332b59c8df2d905916b49acb3063368ea8d6ba09fafb6780dcfefffcf76aea463436860b87fdf9af67aef3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783223519, "uuid": "f836f0f3-4b03-4096-bcc1-b9c849f4a0d0", "value": "T10FE63318ABE001FEE9B7813C9DE19652D1B0B8651B61CEDF2798D7716E532E08C38B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783223519, "uuid": "7351dddc-5b22-4806-86d0-4fc942933c14", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783223519, "uuid": "38ab7109-ae3d-4874-ae2e-558d449e7975", "value": "393216:IPHX1Bpawu+ifaDgNDXMCHWUjXFcuI3/PGTAI:I/lBzbpDYDXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783223519, "uuid": "3715423a-2a00-463d-a6dc-ed63df265828", "value": 14301812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783223519, "uuid": "feb100da-1e71-4c58-86e9-90c43d6d209f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783223519, "uuid": "c02c66ce-3f86-4b01-936d-fe27393add37", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7968655-7896-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783272441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783272441, "uuid": "81cc0e66-7389-4733-b7c3-35f4a4cdbc89", "comment": "Malware payload (Stealc)", "value": "ed2d448debb654e33c8bb0228a1f1b05", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783272441, "uuid": "5c47497e-91c7-45ea-bbc0-c6e2e7e96b70", "comment": "Malware payload (Stealc)", "value": "dc25c03f61ca1ba41a1f6cccad97a8074c2c25158b3ed06e8725101e51e932b6", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783272441, "uuid": "2c2818dd-f1e5-46a1-830b-ad4ec95a2ce6", "comment": "Malware payload (Stealc)", "value": "57d9b751f3cd09b72edad27b3b7851fa134b1328", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783272441, "uuid": "5e1d9185-1ea4-4284-a7e4-c8d79b7b6e6f", "comment": "Malware payload (Stealc)", "value": "4d41c452d5a0a0bbe6b46a63e1d53c6d6a8b7e1f477ca9f3623a6748bb3938c6018390674eca80b7f7c32ef72e8961e4", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783272441, "uuid": "8b815d28-30b3-4865-bef8-f83da34e91af", "value": "T1DBA5331267D8F625F1A4533084FA9533A931B8916E25AEEF31E788BC1E53DE5213331B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783272441, "uuid": "d47ec153-6cba-418d-bd90-f30084c01567", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783272441, "uuid": "8a0569e7-2506-4b9f-942f-e950c227bd09", "value": "49152:hutwILwuc4R2WZhiVx9ypyLrI3dvRZMnXqVdvQNZKJLzWj7IPQUeJ:jIEuJZ0Zy4rI3lzMnXmdvaZi+jse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783272441, "uuid": "86bb5daa-3999-40c8-acb8-dda219e530d4", "value": 2195456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783272441, "uuid": "567acbf0-18c4-480b-ac44-67954b3802dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783272441, "uuid": "d2515208-f57d-451f-bff5-8575e7635482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6562928a-780e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783213865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783213865, "uuid": "2a3a2e1c-af33-45f3-8222-4c850cfa39e7", "comment": "Malware payload (Mirai)", "value": "c7350c957c8fca2cfca4b7807efa9c43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783213865, "uuid": "92e1bf30-7aa0-44c1-b048-0920650fe429", "comment": "Malware payload (Mirai)", "value": "dc3f3a497e0c23bb74713d90a4a4da901c4ad3f2062af803af03179c78726df2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783213865, "uuid": "d39b12cf-0e1f-4936-a396-bdc7f45bbbe5", "comment": "Malware payload (Mirai)", "value": "1839a62746ef12f775b5be1ecf99df0cff9a2a05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783213865, "uuid": "a435dfd5-ecba-477b-bc63-206f4eaef219", "comment": "Malware payload (Mirai)", "value": "c54f3d0e8ccd8b5c2162f3fdff44704660774ed8730d8d8a816cf1e154ec786fc6d199e0231835b9bfad9858e9f7976c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783213865, "uuid": "3623fb32-d7dc-470f-a034-67b2c17905a4", "value": "T1B6042945F9819A17C6C612BBFB5E428D372A13A8D3EE3103DD255F2137DB96B0A3B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783213865, "uuid": "548e95d5-d316-4746-96f7-c5bbd0100daf", "value": "3072:acqDKVGmkvM9wPexJOMcU4OjIarfJDNCEm886:3Vl9/DZcU4OMar9NrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783213865, "uuid": "8b704d53-3794-4834-91c5-14f7921a4b11", "value": 181920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783213865, "uuid": "2942176a-c3d8-4db5-8cc0-3b194da8c683", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783213865, "uuid": "912550da-7a31-44a0-b42a-ecb07d1cc721", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c89970-78a4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783278129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278129, "uuid": "575c0d40-f4de-4330-affc-f0092d0c4edd", "comment": "Malware payload", "value": "6d4797f6d2e9925704d6392ef7e126d1", "object_relation": "md5", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278129, "uuid": "554f31d0-f847-45f2-9c47-760f733469b1", "comment": "Malware payload", "value": "df9ef432a54a9a7bd9987041556d860427fc0f95414eede0343c63d4d9e14ae0", "object_relation": "sha256", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278129, "uuid": "48a7cdf0-efce-4fa3-baf5-273f8c6a57f7", "comment": "Malware payload", "value": "e2e5edeca9e72606be459da5cda79b7cbb00ed28", "object_relation": "sha1", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783278129, "uuid": "ff312173-98f3-4439-bd7e-7a6c39ceed8f", "comment": "Malware payload", "value": "5366163e06b4aa50b96356021343e2bae3170b96d070ef015de9ee811cf08212ee48d50ed59b5f948403f5b385f91dd3", "object_relation": "sha3-384", "Tag": [ { "name": "Cerbu", "colour": "#E330E1", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kryptik", "colour": "#D028A8", "exportable": true, "hide_tag": false }, { "name": "Lazy", "colour": "#4044D2", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278129, "uuid": "64decc6d-d89e-42f5-8aa0-292164ae1271", "value": "T1715528B3A5BD8147ECB4D03586238FB14725F6DC5244AB8760E5E4BCBF07A627E5230A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278129, "uuid": "0226648e-d601-48d8-878d-401b6e2ba671", "value": "b6ff2ea7d4a4f2ee3f8ad0a4bfe298da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278129, "uuid": "828a7d89-d5a0-4b49-8cf2-3d1cad870e9e", "value": "24576:q94T3HFw+ra5XeQ5XFGq3rx0llzBf9xSFF5ywD:q6T3lGe4XEq3rx0llzBf9xSFnyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783278129, "uuid": "1d685345-e99d-40a7-8fb0-a52f0037715d", "value": 1302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783278129, "uuid": "1c2475b3-4547-4232-b6f0-7fccaa86331a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783278129, "uuid": "4432eeb0-1208-4f48-8d21-7ad27f4652be", "value": "START_X64.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfa9866-788b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783267778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267778, "uuid": "a979859b-c1a2-471c-9088-d869403c7ee5", "comment": "Malware payload", "value": "b2a74633bfad39bae05f27e3890010a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267778, "uuid": "81ae5d3d-248d-4df1-982d-247d163e5bac", "comment": "Malware payload", "value": "e093480ce432d25f67d7a7285cd150bc7628036b582ab5b0640fb6b38b311ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267778, "uuid": "001042d0-e8a8-41f7-a5b6-5d3bfe72e4ab", "comment": "Malware payload", "value": "3a198832df4bc591418333cbaebd95b59d251b1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783267778, "uuid": "ebd4754d-918d-4426-b98e-64009c67e8e4", "comment": "Malware payload", "value": "d733676f29d830c9336bccdb2f32ad77339e7277813d9c3196214e6ea07d674b7352819cb76ea3e8fb44fe9d4efe4dbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267778, "uuid": "8676214a-f9fb-42f5-9ead-7237f97bddda", "value": "T144143B27A2AD20E4D1668E3BB4520673E776783507E15ADF4260463B1E3F5D0BE3BB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267778, "uuid": "4e547fbb-b9b5-4f04-8cf6-e55ac91cb683", "value": "6cdaf8e64a42b2bb3dcba623bd36ce5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267778, "uuid": "f9687fa6-2bc7-4fbd-b921-ea390fbb8612", "value": "3072:ip4Z+vRr1X/VBOXZoAH9lm5rX9tQXiMVgecw3L1rmY9OYl+Ge/pk0C3b6F9TY7lD:iplv38ZdmftlogTq15Oa+n/pk0C3b6F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783267778, "uuid": "86887254-9f6e-458d-a6c2-96ca14bbd02a", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783267778, "uuid": "fd1d8c4c-f442-4d5d-a980-31938ae4021d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783267778, "uuid": "5007a342-b450-4874-94d3-bb3368739aa0", "value": "GitAppSetup_version_1.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d61a5-7844-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783236977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783236977, "uuid": "bc28f6b9-7fa0-4f45-8e85-d0827550091c", "comment": "Malware payload (Prometei)", "value": "d9b224e405559c84d6aa053147843eb3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783236977, "uuid": "e44dfe86-a83c-44ea-977c-b7f025b3dc40", "comment": "Malware payload (Prometei)", "value": "e1f7a0eeab8ae793f8a13aeba65d8d4275874261c51feccab9d16f9acb1aa408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783236977, "uuid": "d04167fd-6335-45bf-b20a-285b143aa120", "comment": "Malware payload (Prometei)", "value": "70263e1496c78f1dbe880ce854198b4116502dc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783236977, "uuid": "66558008-918e-474a-b9c5-fe3428b7c175", "comment": "Malware payload (Prometei)", "value": "845d8c2526e998092e3d2f8d942994e9ef1a32815225c7628126bed76752f06280fcb49c49ac7f285192c9633c36bbbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783236977, "uuid": "f222054e-9ec7-499f-bc22-595632c93ea8", "value": "T1E6257D5AF2B370BCD067D030439FDB62683AF47901226E7B61C4DA352D66DA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783236977, "uuid": "b428d8b7-c352-44ab-8f64-2b656d3ac149", "value": "12288:VxgzpAyKBY6jbojbRI41U4ob7EVKfI5U8JmyGCYP+FXkS5k:VxgzpAyKZbaRI4+4+7XQU8nu+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783236977, "uuid": "acb8e730-158a-48fd-90fa-984c56dcf3ce", "value": 1028992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783236977, "uuid": "10827952-67f8-4e77-a171-a0647bb5dc42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783236977, "uuid": "7fe05966-03ad-4e9b-a475-076f251d80bd", "value": "e1f7a0eeab8ae793f8a13aeba65d8d4275874261c51feccab9d16f9acb1aa408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d9d8455-7889-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783266572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266572, "uuid": "e05c9ac4-ca77-4ffe-8d2a-911283c5bb45", "comment": "Malware payload", "value": "fd9677388197e8486452596d1d7aacdf", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266572, "uuid": "3cf7163f-ee69-46b5-b02a-b12704d02bb2", "comment": "Malware payload", "value": "e24a6177f71ee4d453a874dc2ab73168b7e432257183df54a146d9a8ea995c6b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266572, "uuid": "96414b3a-3351-4506-b15d-0f7eeec2bd95", "comment": "Malware payload", "value": "28603e28e274c0cf9cecad3f0483dc3171290bdd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783266572, "uuid": "2892a2f6-16b3-4986-8501-f46e0e4b44a9", "comment": "Malware payload", "value": "e5b885a768feb24bb541b261509cddde320b2c0a1be420c9a05a6a0283eb20cf88ce65e23c18e9618cc206f57482b24d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-password2026", "colour": "#D87458", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266572, "uuid": "f15be1e1-1a60-4b6e-aedc-a18ab2535356", "value": "T1B786332C39059BCC202CFB3E9765049925DFF150563367A98CA7366230909ADEB7AFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266572, "uuid": "389255e5-530d-4188-b480-a32af1fdd932", "value": "196608:M3+VboF7/pcdkd1NVWCpuYrFzGQYVQvSkfLkLdNrYssVHk:M3+V8fcdkZhoYB/YVQKk4TP+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783266572, "uuid": "439715dd-e733-4b1d-b41f-00fa7da64447", "value": 8073379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783266572, "uuid": "c2c19fc8-9823-4868-8e7e-218ef04639dc", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783266572, "uuid": "aa2d9479-b17f-43c3-94d3-5c73f0a1c5be", "value": "clpupdt.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea7b71d-788d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268399, "uuid": "d04de20d-21f8-42bc-829b-142a25b6fd20", "comment": "Malware payload", "value": "c988118c1a7df15a9bf89d304d6a7ef0", "object_relation": "md5", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268399, "uuid": "e22b7769-b172-45b7-88c0-8b8a7a022128", "comment": "Malware payload", "value": "e407452cb95d5067c6916cfa88c3e0843f7dd4cd9261abb854a22d74e9ad1696", "object_relation": "sha256", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268399, "uuid": "d3f43127-8b81-447d-acda-19ac37918c82", "comment": "Malware payload", "value": "1e4e8bedf5d0d503feaedcb5561d936053347875", "object_relation": "sha1", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268399, "uuid": "5b17350c-0071-4b88-af69-a0d58b5366ad", "comment": "Malware payload", "value": "cf8ceaa12abe18be6f3045d1cc4a1c3a93b8509ab8495b52fcdc35d69238980199b463696800162a3aa979eff749b722", "object_relation": "sha3-384", "Tag": [ { "name": "193-24-123-38", "colour": "#B971A3", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268399, "uuid": "ded1115c-da15-4909-a6cb-ca343e9c6c53", "value": "T179D73366EBCB044CC6AECDBAE9856BACA015C210C351F55FA1A8415A3C737E65F1FB03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268399, "uuid": "b0e6e2cd-dd54-4451-bc0e-0d258d69441d", "value": "1572864:+x8sruo9OkW4ofA9K/V0pEwtalnFq4l6pBaQfpEwmemYW:wrg4D6EEwtatFDlMgQfpEwmvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268399, "uuid": "18c437b0-a2cf-4495-b86a-c061d678d450", "value": 58021115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268399, "uuid": "87fbddf5-abed-42d5-b89a-3f3904d5b76a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268399, "uuid": "442c27fa-f676-4d39-8c1c-7439f8d6b9df", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bbcc09-78a9-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783280323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280323, "uuid": "81317f19-046b-4f9b-80d2-b99350a6d871", "comment": "Malware payload", "value": "9d2c007d7eb9f9d8c427cd65b31263f8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280323, "uuid": "ab315e50-d3ad-4ff2-9bd3-86fec8fb4ce1", "comment": "Malware payload", "value": "e4d82fa97ba3bbe5b55930215109a62164e1c4710074b294bfa6fa7f845a9d64", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280323, "uuid": "eb582ee5-11f9-4aa5-a44d-c10d51d0d26b", "comment": "Malware payload", "value": "2584e9cea2a9ccddb9cd0d307d9452925803fdb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783280323, "uuid": "154bcc1b-af10-405f-b279-e016cdb338d8", "comment": "Malware payload", "value": "039cac75e6ca0ee79080d8bfea43465935e2b4968cbe78e395f83fecaac304d75a1263b37de1186eb3d145d1c961fc20", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280323, "uuid": "01ca4603-3509-46e7-ba0a-935d066c9312", "value": "T1E7016BCA8550AE40506E8A1F329B61E4F411C3CE869B0B68BF9C5D3DFB98914B036F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280323, "uuid": "c9159a2b-f80e-4598-a245-66bd640e8943", "value": "24:kXCKysE2hi0ziQvZohanO2mDZkX3pS1DU7:e9Qp+Msnf2e3pCI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783280323, "uuid": "8181af13-e741-41a1-96a7-de91a877415f", "value": 827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783280323, "uuid": "bc332eb1-f7da-46c6-b612-7a8f5bac9792", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783280323, "uuid": "ec31847c-3805-4af5-bdcc-f942e28f313f", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6e1dee-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209632, "uuid": "ad6f30a4-2753-47b6-be74-4c4941f5f15c", "comment": "Malware payload (Vidar)", "value": "14849cd2fbd1dc33147101bb7d028b61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209632, "uuid": "8912bd51-74c1-4a59-9f1d-dbd666b9d197", "comment": "Malware payload (Vidar)", "value": "e74cf40d9df390976e11bad98f81df248c14b6e5a45c889b05095fb66117a83b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209632, "uuid": "ba2f69e0-6a70-4b35-8c53-9816a099e3f0", "comment": "Malware payload (Vidar)", "value": "b8fa979c5b97fcdd3012fd6399a1bc75f22add36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209632, "uuid": "b766ee9b-e3ee-4a68-8d19-102759993008", "comment": "Malware payload (Vidar)", "value": "f0805ea5a24e1c9fc743a1a26e9ac2afc189b003d3f7682844e54ee1622759e3d4c5ea10c9459cf27f1c653800dd171f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209632, "uuid": "3e6696b0-9711-4a00-85d3-50951762054b", "value": "T17AE5AE0B7CE044E9D8AA92358CB751967B71BC490F3267D32E80B2782FB27D09D76B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209632, "uuid": "eb60d32b-b345-462f-ac16-deeb849c897b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209632, "uuid": "0476e599-523b-4d42-9e4a-27d840ecb456", "value": "49152:mJi9PRkDTG8WYrYN1DUTs9xFUU74xLu+FJbN1nrUJIPVgaGD:mJikK7LMi+GIPVVGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209632, "uuid": "2300ab9d-a8ca-4232-89b8-7423af05e441", "value": 3022176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209632, "uuid": "30ce47ea-7318-44e6-9f6c-64f91230aa27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209632, "uuid": "4922debb-15b0-4060-8cca-3b130fbdadcd", "value": "SecuriteInfo.com.Win64.Evo-gen.79583238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3414617c-7868-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783252437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252437, "uuid": "e86d5507-94e1-4943-9f78-870e08efbb47", "comment": "Malware payload", "value": "53105ee2124462304edf5d6c33039390", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252437, "uuid": "7152bdc1-7da1-402e-b896-4d06363d292f", "comment": "Malware payload", "value": "e7f8f3b682ce961595cc791d420de38bb00e7d55d32b57e3c69760a49f5aa15e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252437, "uuid": "964b5307-5629-4abb-9118-4911bb1282cf", "comment": "Malware payload", "value": "17b8336356b7cab11003150232efd824f835c750", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783252437, "uuid": "ec03fe96-73bb-4fef-8380-35af21989f90", "comment": "Malware payload", "value": "8eb707b2b5684130d87947679a7917320e5876a5d219ec2222d795a0510bcd0527be59bda446bf9f4be52223dfc68b42", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252437, "uuid": "d1e93c71-3822-498f-af38-2fb367db5ecf", "value": "T19971F1861B8038149747ABFF312B30A9F55B5FB61944189BE0D0F4A4F8F06359392BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252437, "uuid": "0387fee6-98d2-4d2d-8abe-b4dbb24ed81d", "value": "96:Rudhhe7SmyUiNW8ksZwpYnba29HRV1/VaGxse3HDMHGls3SV02n14d:RudhGiVksZwpYbauxT4GaPHi3+2n14d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783252437, "uuid": "1ede2111-6044-47d7-88c1-075b91ad36e2", "value": 3497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783252437, "uuid": "d28aef2d-7964-4073-b0e8-89409ad57419", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783252437, "uuid": "99ded235-8016-4a1e-ae72-162c02336f56", "value": "tr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8682e7-7863-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783250496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250496, "uuid": "997125e8-cdee-416b-b474-61b06e12da32", "comment": "Malware payload (Vidar)", "value": "1deb209a52e601fb9f0117d72fc7d0db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250496, "uuid": "ea8ec3b8-715e-41b9-ae1b-fbd6b34f4e01", "comment": "Malware payload (Vidar)", "value": "e957e67ed9787dc7941454ebba020699013e0a0cc00a99c36960a71bc6ab44f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250496, "uuid": "10070dd9-0175-4191-bc7d-45a43ce3832b", "comment": "Malware payload (Vidar)", "value": "cb981cc97eb13f5948bd10ac3b63671d66841a7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783250496, "uuid": "2d655799-818e-4442-b3e2-0e8d8020b1da", "comment": "Malware payload (Vidar)", "value": "d733526b2d06db6b758b2f01f2111713c46ef06a0b91566034dc9df1bee7b7cfaffade3dfde39cad9776b277cf6481c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250496, "uuid": "cd3bdc5d-094e-4c8c-88ab-ff4497ebb61b", "value": "T166C36D597783E0B2E44D2375627E377DCEB09E353C90CA6BDF803D0A9E2A190535A16B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250496, "uuid": "c0209356-6d7b-4cd1-9cff-b2b8aff461f6", "value": "88967e8dc94c2149dd89b55f39e46fa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250496, "uuid": "627915f0-c23e-4e65-b3dd-2311fb8e9d47", "value": "3072:QEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfavXU:z3h0aMJ+Hw3Pgen79/Svk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783250496, "uuid": "20d526c9-1e52-4643-aba9-38cc289d4421", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783250496, "uuid": "36e21b9f-a0d8-4bae-8605-6f417725f305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783250496, "uuid": "d772dc0d-eda1-410c-9142-4e12276208af", "value": "e957e67ed9787dc7941454ebba020699013e0a0cc00a99c36960a71bc6ab44f7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69807cc6-788e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783268847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268847, "uuid": "eae1eb6f-12d4-46c4-be33-2dc157499332", "comment": "Malware payload", "value": "06b37b71347ae7cb43fe035fb9d5b2a6", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268847, "uuid": "14f5daaa-e40a-4aa7-806e-8a97f4f664e7", "comment": "Malware payload", "value": "eb530402b07763a24a506d0e417e2459b38a6c31c67e9ccdc168df04aa6e1782", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268847, "uuid": "87a36051-590f-4baa-83a8-b8dcf5a87a51", "comment": "Malware payload", "value": "16066016b1f97c80c2e56a0c21e06d651c7466cf", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783268847, "uuid": "1a9960a9-b19b-4742-90c9-bd060bdd2e90", "comment": "Malware payload", "value": "b025419ddab1eea54d86961dd8b76ed7aef3959f2fca734aa7dac97d4cf76001711c412e6083fa6cece8cae35f369d13", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268847, "uuid": "1ce1b4fa-f546-4b5e-8e71-5b614f48a2ee", "value": "T14995331817E490BDF4640B34E8F260A286307CA96B32959F36C5777A9E733E8757234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268847, "uuid": "5cf06282-38df-4bec-a2db-5176b55071a8", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268847, "uuid": "31253264-1b3e-4ecf-a267-652e70639731", "value": "49152:uuNbYQq2yWuAPv4pZ0oZ0dsbAhdJ6S29acD:bb0WuAyaOb59a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783268847, "uuid": "7a0bde42-18bb-4423-ae3e-3899e6819d9c", "value": 2056192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783268847, "uuid": "e8478684-a0c0-44ae-b155-99be68ffc4be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783268847, "uuid": "a492f1c0-14f0-44dc-9ec9-bfe23993eee7", "value": "kythy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c19577b-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209608, "uuid": "d4d034bd-ce66-473d-95e6-120fa799a35b", "comment": "Malware payload (Vidar)", "value": "f853d193d83029352212ae5135589816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209608, "uuid": "01514217-6895-46be-873c-9747fd98de79", "comment": "Malware payload (Vidar)", "value": "ec59758993501d25047672e4c46d33d7489012bf3936832af18896fb1bbef109", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209608, "uuid": "5ac3689e-6ed6-4f88-b50d-7fbf690b56eb", "comment": "Malware payload (Vidar)", "value": "af7c9e5a99e1d7de22f316eb0ccd9c694ed26f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209608, "uuid": "124ea258-378b-4009-8bd4-d8990cac82c6", "comment": "Malware payload (Vidar)", "value": "50430775191d5390cd40af005c46afd6014fee413183beec246b7f4e9a1774f0434230a99e939c2ccb820da7e9fe90c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209608, "uuid": "07bdc8f5-5ff3-4878-9883-382032671c2c", "value": "T159D5AF0B7CE408E9C46A573688B252927B30BC564F3263D72E90B67C2F76BE09C79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209608, "uuid": "7f1a7ba4-b80a-4c10-843d-086da8ddf522", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209608, "uuid": "44a8a127-79ce-4c76-8117-178e738209d8", "value": "49152:o124yaD0luCrOifPzJTy+6tqi4iYW5nwngA:o1kPXz5y+6155nIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209608, "uuid": "8b463323-3b57-4402-a114-2ed25ec1ee5a", "value": 2958736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209608, "uuid": "d060f934-9d40-4844-9bad-c14d3ee219c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209608, "uuid": "cd201e6d-5bc4-4068-b297-b65d81bf5a1d", "value": "SecuriteInfo.com.Trojan.Siggen32.62620.2012.11636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854c437d-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209623, "uuid": "bbb0fc90-8f24-4a5d-a4d8-bf2c8fef71be", "comment": "Malware payload (Vidar)", "value": "e1a2c6e811791ad672f8f600257c5fe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209623, "uuid": "2103fbf5-6b2e-489f-a196-27ade90ac91e", "comment": "Malware payload (Vidar)", "value": "eded86eb5c664d712b1393001d997338d122e53b15885adc4c89d2421a412f64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209623, "uuid": "4338e151-9f96-42ad-a5e1-4cf22afd9d66", "comment": "Malware payload (Vidar)", "value": "fe459ec940c0a2fecfa72ced9003c6be44af8865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209623, "uuid": "6e61153f-182f-475b-813f-02c4494e38e6", "comment": "Malware payload (Vidar)", "value": "c711c3d2982ed5708b97d00d03072797e701e0dd679a36c83b7a3b5cfa02f4253de19f0fe7c43aef15cfb307574477c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209623, "uuid": "67624ec6-f448-4f9e-a13d-d3a27c384cd3", "value": "T1CFD59C4A6CE049EAD49A973289B612867B74BC490F3273D72E9073783F72BD15C36784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209623, "uuid": "106de443-5394-44db-9d1f-d9a215d1f5e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209623, "uuid": "fd11a38e-990f-424b-87da-18e70d661200", "value": "49152:u5I1RmV9Et/vSi9X5XYzeZXlWrcwRZGuX9vlmNK5ktm5w+gclC:u5SAUIzeZwrpRZGuX9vlmNK51K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209623, "uuid": "60b35d61-618d-476a-afe3-ed4dbe4c194e", "value": 3018112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209623, "uuid": "4a8303ad-ff41-4869-bcbb-8d3354d4c455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209623, "uuid": "504b91cb-d20f-4861-9876-e52929fbd940", "value": "SecuriteInfo.com.Win64.Evo-gen.87659349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb80b17-7850-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783242331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242331, "uuid": "9a92da65-423a-42bb-b6c6-e27b5f8ecf70", "comment": "Malware payload", "value": "4cbcd52b2f3cd4812c8cc422104e5872", "object_relation": "md5", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242331, "uuid": "a6a3e006-90b6-41f0-bf8a-8cbf50a22098", "comment": "Malware payload", "value": "ef222b4d06b8c521699f14a0c2b4db4bd680df68d484600d39075ba019d68c16", "object_relation": "sha256", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242331, "uuid": "b67e5fea-9cbc-41f0-a720-27c1118e6768", "comment": "Malware payload", "value": "1794d1624ef24bfe91a09ded7efcb4c43955696d", "object_relation": "sha1", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242331, "uuid": "3987577e-e2bd-490d-a78f-c1bfe9078a13", "comment": "Malware payload", "value": "909ac6140abb794cdd8d046a0d9389964dbb339ad494de708a109fd72c964213a57e4a53b66d385f9c73ddae00fcbd50", "object_relation": "sha3-384", "Tag": [ { "name": "agent", "colour": "#33525D", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Generic", "colour": "#12E30B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242331, "uuid": "35b60f1e-60d1-4a14-89d9-c5f97691f9ea", "value": "T1F8A3F1038BF21966E7BBAB7094F1C610E9F0F5925970A90F330DC15A5F2AB413E1766E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242331, "uuid": "c1420dd0-9f0d-4196-a0c2-ab43477ae02d", "value": "51edcab044e009fd014c847b607fcab1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242331, "uuid": "3abf8933-48b2-471d-9cd4-2cc95a20a018", "value": "1536:YDfRXBjlpvXjOWe/lNNwhbu+Ei+b9YdRxMW5hKc4zlfKOr1yAWzPz+bGVa:K5piWe9kVEiWSZjnOr1yAqSyVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242331, "uuid": "3892fe9d-1a1a-4411-aaa7-a87c5809a15f", "value": 103608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242331, "uuid": "56401fb2-c7bb-498f-b466-f5e579b0a6ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242331, "uuid": "8c02b716-c5f1-4f41-8074-a515e8ca9b86", "value": "Voltrix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ddcc21e-7846-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783237931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237931, "uuid": "e85cba37-c4bd-41e7-8d1f-5e022bfb3dbd", "comment": "Malware payload (Efimer)", "value": "17cd659fb2b7797352e5c33ce77d6cdc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237931, "uuid": "ecec26bd-1d7a-4c90-9de3-d5e4f93a9bdd", "comment": "Malware payload (Efimer)", "value": "ef8fb137711aba179550d97b4dacda5644d17482b64e142934f429306044ce6b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237931, "uuid": "f67b18ce-af81-4663-acb8-48f51e5ffdc2", "comment": "Malware payload (Efimer)", "value": "69e258ea6cb572bdb95f031ff22de0ccf5cfed05", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237931, "uuid": "e1716bd7-3488-4961-9255-094fb60f780e", "comment": "Malware payload (Efimer)", "value": "9749c7d0e1433f61a0e95ac396fd2d044ea48bd9b343a6416e9e3f47e3d974d9fb3b9b2b2f8a9cc64aec5bf1857e9b92", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237931, "uuid": "2bd1335c-2247-4c17-9d5c-047ad402b2e6", "value": "T129E63314B2E153EFEAA3503CADA194E0E4B6747A1B75C78B4B7883453E672D0193C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237931, "uuid": "f3f51719-23b6-4487-9004-f5868d91f19f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237931, "uuid": "9fb9e5da-f901-4c1b-a3d1-8f3ac7608a2c", "value": "393216:M9EMded0fBIfJTf+PpJiaL7XMCHWUjXicuI3/PGTAI:M50qJ8f+PHiEXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783237931, "uuid": "9efd59b8-b30d-47e2-8bfd-8a0eba0f837b", "value": 14235544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783237931, "uuid": "0042ba4d-cbc9-43dc-b0ed-6f81a2ce4aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237931, "uuid": "e426b5ca-5456-4a78-8b6f-b55d7133ef44", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6639df2e-7846-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783237918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237918, "uuid": "8d0694c5-bde4-4b8a-9942-6d26bf7a77ba", "comment": "Malware payload (Mirai)", "value": "98b8459ceacb94ec3aa839350e09f75f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237918, "uuid": "f1f42ee8-303f-41b1-b3a0-d23564c66bc4", "comment": "Malware payload (Mirai)", "value": "efbf4e145f16f45ebbf0a35433b485b218e6df7e7bf144fd2860178cb31c7d26", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237918, "uuid": "fb1be20b-04d4-4b8e-95f9-ee1f1dd3efe4", "comment": "Malware payload (Mirai)", "value": "3ad20674374ec26f72f116ca51452e244dfa9f3d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783237918, "uuid": "1f9844f6-435f-446f-b95f-af6c4248256e", "comment": "Malware payload (Mirai)", "value": "2dff3e347d47f0717dd3ae5c1ce828bea9f538692dcc9c6e2f99751ea0f377ee3b10b1b34b19dbc95eb9c05efdecc2f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237918, "uuid": "3528b39e-c8f6-45f1-bae1-ef1d6f4298f4", "value": "T1658302FD7A0A4A83DC0F5D7467E612919E3C1B6AE42B8C1401395BC2EB09349FE9D8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237918, "uuid": "660bdc5e-3f63-44c6-9458-a0f7c0748f16", "value": "1536:LoO60GuJ0X7p8z2/mUe1DtoFsdnY/K0uA/dh3Hk49OKXWtzZklvD1V1cI:L3Jg7p67kAGjx/dREiXoNQD1V1n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783237918, "uuid": "ef963f8f-812b-433c-9665-1e4aebb26eb7", "value": 86028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783237918, "uuid": "0f161f14-fc41-4a30-ab83-9c33d030cb10", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783237918, "uuid": "0e9563f9-3bbd-4ea6-b799-7bfa569eb8d8", "value": "dg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda3f111-786e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783255325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255325, "uuid": "7e096dba-3675-418b-846a-12029a9bff28", "comment": "Malware payload", "value": "e5cca0194e703a0bcdc2503c49e37032", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255325, "uuid": "92606f66-0dad-47d6-8cb5-e51e5eb82d11", "comment": "Malware payload", "value": "f165dff86776b4218deeea801ba3d8cfa22cd2abe2758cafb82c5e40fc57aef4", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255325, "uuid": "7e3ba3a8-dd7b-4337-ab2c-64e3a3fd5c39", "comment": "Malware payload", "value": "e248791fa3731a84ac07eafda0c9dcc85cc466bf", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783255325, "uuid": "a6f77b07-bebe-418d-a405-7d6517bca81c", "comment": "Malware payload", "value": "e9dfe73ef9c78093d62472d7cb19e489f2da4d938e5be2a9a952ccc0bf88029c325bcfe0dc8244389d859c27c07fe93b", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255325, "uuid": "e26d42c7-f17b-459c-8d13-bc11b240dac9", "value": "T16101F45CA1A4EF520ABDC545F6B15519C491A0EBE1F5E7C1F28E0E326F6884A2E6320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255325, "uuid": "42b168a0-fac2-412d-8ba8-af3dc50dc6ae", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+QGCjfWDxAjQD9GDwZhG+E6:FH8j/wWi2jz8G2fkGj69Ge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783255325, "uuid": "3e47e52a-ea20-427b-af57-eb6307606e1b", "value": 689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783255325, "uuid": "44df99eb-0bbd-479b-83bb-0cd0e2c6062f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783255325, "uuid": "2f86fbc6-f052-4355-b2df-4a82fc2430c0", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ca552e-781f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783221173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783221173, "uuid": "f6c94d4e-a052-4b9e-a7fa-8cc37cde174c", "comment": "Malware payload (RemusStealer)", "value": "4be39027f6e94c46bf4307f6762d8b98", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783221173, "uuid": "b5b0e381-40d4-4317-abb7-77dda7e1138b", "comment": "Malware payload (RemusStealer)", "value": "f193b47f2739aaa35c0ecec5d2731dc7d343c200340015e4a2bff663c3041512", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783221173, "uuid": "e9c1e7e2-31b4-4ea0-abcc-6cee1bf70954", "comment": "Malware payload (RemusStealer)", "value": "def05ff2de5bf7d550e6230c19480bae253d8043", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783221173, "uuid": "96938ab7-f724-4f5d-b201-7764e7055817", "comment": "Malware payload (RemusStealer)", "value": "38c3c1e8373f8bd2b80f47f8102be068f05c45ce550aa878b7b379b136fd8442dd3daebb6d9005487b48ede88746dc54", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783221173, "uuid": "c9698063-9961-45ab-a2bb-537f30e01996", "value": "T10E24292BD25375FCE552C03852667232BB32BA3D47309EF70392D7359D21AC0AE79A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783221173, "uuid": "c93b872d-4b47-4f93-aca6-f151472a1194", "value": "20f35ed688f00eacb2c7ea603d9f248e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783221173, "uuid": "7b413243-86be-4a1b-9ca3-25124c262452", "value": "3072:9SziFM0L3isiMJbXeEyqAbAMym8D68pnqWrrorGkM54Yqn:cilJjOvB8DHAWH8HYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783221173, "uuid": "ee41ae1f-e55d-4df9-b89b-738c807973b0", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783221173, "uuid": "ebac00dc-1a76-448e-8d32-589ed174e967", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783221173, "uuid": "8ada9738-3dd6-4be7-8213-69304cafc616", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e05b01d-7804-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783209638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209638, "uuid": "02826a72-da42-405c-b943-96b717baa25e", "comment": "Malware payload (Vidar)", "value": "3f765f2396c7f2df4753ef0b02b20f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209638, "uuid": "1a903bfc-893d-4487-aedd-1dd99766c67f", "comment": "Malware payload (Vidar)", "value": "f23e6b705868c3d3a6615be240bfa23620b0b873fd17b12a9481f7580a18ec75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209638, "uuid": "95e610d3-9791-4497-ae61-1b26daa33432", "comment": "Malware payload (Vidar)", "value": "64c1b72294206007c43834fc70b3fa299ed6c3d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783209638, "uuid": "2c9656db-a068-4700-8d2a-b6642ee7051d", "comment": "Malware payload (Vidar)", "value": "6aa608cef388b7cdb1991566c78cc66f7e4a4c643d2ae8fa6c4f91e221e4bc2afcd4f1a42597b320ea998782f415e1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209638, "uuid": "13a6ef36-42f2-4b65-9aec-48d61cca36da", "value": "T14AD5AD0B7CD545E9C4AAA3318DBA42967B35BC494F3227D72E9077782E727E08D36B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209638, "uuid": "2fe75d1a-4dc5-4046-99a2-f347a3ac0ac9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209638, "uuid": "7f7476da-a1c0-47c0-a602-40c5d3ee8347", "value": "49152:V50BJeqTR9up7t8eoqvBkoA/+h7r0hri4Hw95gZ:V50dGN5kh/Of6rDQ95m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783209638, "uuid": "fd48962d-f206-42bf-99fc-f9b5a8cbba65", "value": 3019104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783209638, "uuid": "f142e00d-a67e-4db3-8640-0e911fdc0b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783209638, "uuid": "e3bc826a-31ef-4ba3-b667-745022bc1196", "value": "SecuriteInfo.com.Win64.Evo-gen.45211965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a531daf-7840-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783235187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235187, "uuid": "841ca1be-21a9-4f5b-ae4f-19a9d9ed6419", "comment": "Malware payload", "value": "79159b95ddd273bce5910e3b9d7eabf8", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235187, "uuid": "0ad8644c-1cd8-4654-8db3-9b2439c75678", "comment": "Malware payload", "value": "f2a5a9ab670552598f032f8c0e22d6ff67bd5061eb33b9efe3251082c044c71c", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235187, "uuid": "03175c18-21ce-4ac6-8ed0-247998c8a472", "comment": "Malware payload", "value": "d08124833c3ffdaf3ced2dfcaaeca66a486293b9", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783235187, "uuid": "6c4f839a-ddbc-4432-b009-cf2478870ef5", "comment": "Malware payload", "value": "0cc0c49a1539f6c8beaed02f487336e3bfe0944338aec93fb4ae02a8a4038c57666dfd85044b76e37a550ee302d56a2e", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "kenwillzltd-com", "colour": "#3AA1AD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235187, "uuid": "7cbe1afd-c395-434c-b425-e99e3422217f", "value": "T1D8A2C71B332758F5C3C17A6588DBA108FA9004B3605EBE9CF49C5291EF72A2293FC752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235187, "uuid": "fba9b398-5e25-4708-ac41-d8b133327df3", "value": "192:GaPyRegRc1mh3BmCX5Mjnm1z0T9/T9IdQrAQ9PDbSIGSIaFflFy6Uoqi8cqoYogZ:H3m6Pn7pdqoLgaaIppCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783235187, "uuid": "13542a8a-71c1-4657-92b2-91c4c809757d", "value": 22417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783235187, "uuid": "7fb757f5-3036-490c-8516-a89d7ef75160", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783235187, "uuid": "7f387a19-0e6e-41ce-9fb4-20a50a888c6b", "value": "sunsolar-sz.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd339a08-7880-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783262975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262975, "uuid": "84abe0f2-a1f3-45f8-b26f-5a7163e5d1b8", "comment": "Malware payload", "value": "8ea7b477c21b0244f0a20d8c82fada30", "object_relation": "md5", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262975, "uuid": "e632183c-09a1-43fc-a760-4991932a628b", "comment": "Malware payload", "value": "f3235734705a7408f7fb009aef964561ff819e1074d691276d467fc2f98b4376", "object_relation": "sha256", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262975, "uuid": "a13d0c26-04dc-4a3a-b012-20312cfd70ef", "comment": "Malware payload", "value": "0d3611004ddcda2c9ce060f808a334b06dec5f36", "object_relation": "sha1", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783262975, "uuid": "6533e266-c7c1-4f20-9a66-c03167e38c60", "comment": "Malware payload", "value": "d619145b29d89114ee516da38b256e2191a519a7f7e049d3bd7316d0ca071258ad1d5b158df8da391b43b407433a6875", "object_relation": "sha3-384", "Tag": [ { "name": "BruteRatel", "colour": "#B8B72C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262975, "uuid": "4800361b-9801-4db1-bea9-a95d8bb38b65", "value": "T191082342B69905E6DDE79778D1A7833AEB70BC2007214AEB5524F72A1F337C16A3E701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262975, "uuid": "abedc892-1bb0-4aba-a557-4db30ae59c06", "value": "711977df1798580784450733196e842d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262975, "uuid": "0a5b8394-9059-43d5-89fc-85324e2a3c2c", "value": "1572864:sbyX8F+EoPXlgOv4cYKFZ9Mcbfv3O+MkSFL2zJ+SS27/MhqYJ3:oyMFLyXVF9ZVb++8gUJ27eZJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783262975, "uuid": "d374cbcd-828e-4be8-b013-1c048f45309e", "value": 80971264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783262975, "uuid": "f7fef753-008a-4128-911f-08ef49bd7956", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783262975, "uuid": "2c194c8b-a4bc-4b05-b7f8-62078fc9af20", "value": "\u6613\u6b6a\u6b6asetup0704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb59387-780a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783212375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212375, "uuid": "a2688380-2526-4e90-84b8-fbdafd81161e", "comment": "Malware payload (Mirai)", "value": "7144e9deb23ea76b159f8640766d1155", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212375, "uuid": "5e92cb75-d932-4a16-939c-663888e35a6a", "comment": "Malware payload (Mirai)", "value": "f37cc14d7aba3e5acb68885336ccf3882c61d4220c50618d0344aa874b4f0fb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212375, "uuid": "6e8e62e2-e551-4c78-ad4f-e4f057aa1451", "comment": "Malware payload (Mirai)", "value": "e52659901d465800df1706a00071f75ace1f190f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783212375, "uuid": "7d14eb97-2327-4f93-8d8a-1e2a512e866a", "comment": "Malware payload (Mirai)", "value": "df7507f5b48d808cefedc0372e5f19240089e65af2dfb8da6d85bd2082883ad9efbf542057c0351bc61c5caca739c417", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212375, "uuid": "39253fad-e3be-4aaa-a594-92d1bd5bab0a", "value": "T1AE141956F8819B15D5D112BEFE0E128D33232BBCE2DE72129D246F30778B96B0A7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212375, "uuid": "ec92c2f1-394d-4a31-a088-7b798fd70bf3", "value": "3072:5yopnl2EQiEV+UZsFgp1tyhUS1EArXG9soYaav2psJxDdhAC3Vd3R5Kf:dnl2EQiEAqc0byht1rXcsZa5gxDQ+Vd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783212375, "uuid": "f1304fb8-bee1-420d-b63c-10c54aaf2b3b", "value": 195868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783212375, "uuid": "796d8db7-4c65-4db5-b706-d193143748c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783212375, "uuid": "c926bec5-2614-4c6c-9520-7d4935b6b880", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc53171-7833-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Redosdru)", "timestamp": 1783229985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229985, "uuid": "a2a22c25-bdfc-4d26-8954-ed59619f4ee0", "comment": "Malware payload (Redosdru)", "value": "b2f641209efa51dda327fb48bafd0986", "object_relation": "md5", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229985, "uuid": "06e0fe4b-5703-4893-b612-33291d00c2cf", "comment": "Malware payload (Redosdru)", "value": "f65a25e37c7abc88d641e13004c4e5523502b4568cfcf6713f4f50e34f23e770", "object_relation": "sha256", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229985, "uuid": "58ddd167-53a1-4641-a7c0-b2f1f758d7b6", "comment": "Malware payload (Redosdru)", "value": "0b5439d135dc4d685e3fa346ac56dc89713b1a86", "object_relation": "sha1", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783229985, "uuid": "17dc9bf2-c33a-418b-bca2-67515554c68c", "comment": "Malware payload (Redosdru)", "value": "848df4b919ee13be1291600200f03319400ddebfabbec1f8b776cc81f90eaf67557c7d38dabc1fd86056405bd90e2afa", "object_relation": "sha3-384", "Tag": [ { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229985, "uuid": "d5cc5199-5ad8-4a49-a948-5f84516aab68", "value": "T197D4F21DEF2EBCE4F91E53BE3530482A3F519926B8BE586D61526626CC34343409BDCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229985, "uuid": "2e3d32ec-5c64-45ab-972a-09ebe458de20", "value": "f2b391a4d3eb9bd6a54cf7e0b90ea68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229985, "uuid": "f17abae9-7e3c-48cd-8a96-7c31c62e5f94", "value": "6144:VmPgvqJJWgEmEizgdS7Mm3o0wmjrdABecyw:VmUCJktEMm3WmmBiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783229985, "uuid": "583929fb-918c-41b2-a061-a62128ba1828", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783229985, "uuid": "6d72a16e-3e0e-480a-9976-70dd19af413c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783229985, "uuid": "fb15ab9a-225f-497e-8637-1c3ce291c7d9", "value": "sample-f65a25e37c7abc88.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c7c00a-78b2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783284539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783284539, "uuid": "dcf0bc30-4a7c-46db-9e25-812f938d1f93", "comment": "Malware payload", "value": "f9e169dbea915adc22f75a7e45edaac2", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783284539, "uuid": "be080cc3-4772-4f29-ae69-7ec151c1da5a", "comment": "Malware payload", "value": "f7c6561a918ef565f49fd35aada047b70fde12cfd5d98b0704c7353d48d06db0", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783284539, "uuid": "811e4e7c-c3a4-46e6-b7de-024f89496fde", "comment": "Malware payload", "value": "b2f42ec8785e698500da0fc52195742d5b023cc4", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783284539, "uuid": "1faccce3-9bbc-40e2-9c4e-aa99c46890ca", "comment": "Malware payload", "value": "af387ba6c9cf1add738434c240c6f7c0d47463efc8e3b6d95556a4b86d2e568464e0ef314a5dc7f78bb3ba8e95cfbe04", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783284539, "uuid": "d555d9e0-2937-4c95-9a86-5ca93a7f0a29", "value": "T16F1833145F548CD6F99231399A916244E3E3BA6417B08BAF0BC06B212E375FBEC7D361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783284539, "uuid": "3db5e2d7-da9c-4476-9e95-a62dac1dac68", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783284539, "uuid": "521a63f4-ffd2-4ae6-b92b-8681ef7dfbf5", "value": "1572864:qAYyyxBU7rUFpY+HK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:qfxgkeUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783284539, "uuid": "5461747f-a105-4d35-a833-e43317817be8", "value": 85021383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783284539, "uuid": "719a6465-a0c2-49e6-958b-d22dffef40fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783284539, "uuid": "69f62964-b4c8-4aa1-a63f-0601c80275d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f236ff15-7873-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Sliver)", "timestamp": 1783257480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783257480, "uuid": "89ac0f84-d88b-4428-9e0b-5fa7b280bc98", "comment": "Malware payload (Sliver)", "value": "2313d1215e400d4af33ac6eaefc6d4a1", "object_relation": "md5", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783257480, "uuid": "fd459c0b-4517-4ceb-8323-229dd73f35dd", "comment": "Malware payload (Sliver)", "value": "fc4803bb4c3b92b0a15e94d83034256b3deaa5e00b85fcbe1882fd241dd6a679", "object_relation": "sha256", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783257480, "uuid": "0550a6fe-54a3-43ec-8af3-6e5b2738b523", "comment": "Malware payload (Sliver)", "value": "4c043caa75192cdf2a7b9d08de3f5e281091d7a4", "object_relation": "sha1", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783257480, "uuid": "4716bbec-4f89-4be8-b15f-30251c877ea1", "comment": "Malware payload (Sliver)", "value": "7d3fcb79319626a1f966b2e4dd34208c86bff7dc2de0476ee38e406ba16bc51897e54d485a9baa48780792f9b9c4e183", "object_relation": "sha3-384", "Tag": [ { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783257480, "uuid": "adcf9522-154a-4022-be20-ef8458e8cbcc", "value": "T188F60A03E8D510D4C4FAD2B489214262FA70785C1B7973DB2BA1F7B42B327E49E7A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783257480, "uuid": "f76a1127-8aed-4e96-b3e8-25f30849ea47", "value": "196608:x9mGphGpbnqGfH2wcPYxBMJwMJt2sV2NCC:XphkmoHJunv2sV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783257480, "uuid": "95c6de4a-e387-474e-941a-09b9e717960b", "value": 15646720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783257480, "uuid": "c12ba946-ed14-426f-9172-67c25136861f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783257480, "uuid": "15c7d0d9-dc78-4f0c-97bc-c7f70b9ffc6e", "value": "gh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d3c982-7852-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783242944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242944, "uuid": "c4213d2b-41a7-43f8-9449-042c9635663f", "comment": "Malware payload (WannaCry)", "value": "342f8fe9a988cbdb27f7756a2754549d", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242944, "uuid": "0bb3226f-0f93-47d3-8548-4f68ac02b1e3", "comment": "Malware payload (WannaCry)", "value": "fc772ded09936960f85abe63e2162ac141d072eeb60d3f5a4c0e47f249c9b6a9", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242944, "uuid": "797fb24e-458a-4e1d-8b4a-2a91aa93d0e9", "comment": "Malware payload (WannaCry)", "value": "161a0dc51f1dd79421194ab79236159ae994f688", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783242944, "uuid": "7f5f71ca-1dee-4ec4-81a8-76dc9c948f59", "comment": "Malware payload (WannaCry)", "value": "d65f24ce13c5a2654b43e42cd2c448ea6165c8503db49dd7c18108cad8eaaf694043a6e3ce6605fe8df7df52ee85c1ba", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242944, "uuid": "b7df654c-afa4-4a7a-8342-d367689b5f98", "value": "T132363901D2E41A60EAF25EF6267ADB10473ABE46D95BA65E1221504F0C73F1CDDE2F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242944, "uuid": "5ba770a9-f358-4247-9aec-3e2487f32d3d", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242944, "uuid": "e31eeab2-df83-4734-865c-3389672d946f", "value": "49152:jnXnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:DXDqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783242944, "uuid": "269a450a-ca52-4c21-b1bd-4f277de10270", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783242944, "uuid": "02fcf186-9be8-434f-9447-438644a736e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783242944, "uuid": "f3c60dde-033e-403d-8c03-7d54c0663d09", "value": "fc772ded09936960f85abe63e2162ac141d072eeb60d3f5a4c0e47f249c9b6a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93234362-785f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783248731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248731, "uuid": "49b49260-6454-4e7d-ade9-e0b309b33392", "comment": "Malware payload (Efimer)", "value": "22a485db3175a269c6f1b9895e3c7f53", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248731, "uuid": "3dea40d8-8ddb-412e-924b-d5face74a9de", "comment": "Malware payload (Efimer)", "value": "fd834934b8de230554ae62d2c8607b1d5ada181d34140085ccf55560c4b92d18", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248731, "uuid": "8812e7cc-60f7-44f7-a402-10315d97a8ed", "comment": "Malware payload (Efimer)", "value": "16a7e8cf3ff3ac1d3992036de4f16a3afd9ce177", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783248731, "uuid": "e1e14cb0-8e53-4953-a4a6-5d9cc29339c5", "comment": "Malware payload (Efimer)", "value": "664cc982a56eb2284e1b1db80129b575c4df6332d03eb1f6ea300f942df074d4cc1906f2af9ed7ecaa734bf36f4b3b1f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248731, "uuid": "9dfce427-9335-4007-aaab-0dd575c2ecf4", "value": "T194E633986AE156FEF2A3913CE9D219D3D5A970764331C8DB07D84BB16E330E05D39A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248731, "uuid": "1dfe66ef-b152-44f0-bdb7-3e77ed46d742", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248731, "uuid": "878fa4d8-145f-41b3-88c7-5b4d2c48df97", "value": "393216:d83etD6Tgc2aYqUFuJzNh94jYZ9eK1NrQXMCHWUjXzcuI3/PGTAI:O30DWJ2DY1pZzsXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783248731, "uuid": "d16aa286-dfad-4a03-b47c-10d5be70c5c4", "value": 14308356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783248731, "uuid": "dd34941c-36f3-46fb-b5c3-43aa8c92fbd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783248731, "uuid": "c9eac4b9-01ec-445c-9803-dd939977f950", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05cbc5-7857-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783245444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245444, "uuid": "af5ea974-b1e8-4733-9079-7f35afa0ecd6", "comment": "Malware payload", "value": "1b622344e22741b6acabe8f05496d6b7", "object_relation": "md5", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245444, "uuid": "3448a540-9aff-4359-8e72-7fe5d18f12b7", "comment": "Malware payload", "value": "fe11b95e0d27b98e9cf5875d0e01378029c8948dd8515ee0ace4450eb8441913", "object_relation": "sha256", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245444, "uuid": "db96a5c4-0458-4c5a-973b-9b8371181d5e", "comment": "Malware payload", "value": "08af7c94a3231fb29bf32063a3087e5233780bde", "object_relation": "sha1", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783245444, "uuid": "4374bdfa-4942-4ca9-b66c-6f300fa080fd", "comment": "Malware payload", "value": "6e4eb5f8957ee0a44edaf65fb33239294553dd3444e9d2a3cfb20b2e1e2c75b5b434d103b1cfaae31691c6d3ac690e33", "object_relation": "sha3-384", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245444, "uuid": "e89aa3d5-9075-404b-a3c0-ef9a90951dcd", "value": "T1EA91651E0B6B6BB06DA3C65A81BE08055174170F2011C9C6AD95BE938F7D7CCE17A7B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245444, "uuid": "6e46d8bc-4e59-47bd-9874-0bd4df9354d1", "value": "96:bh5Wd43W1A2uQNfvnnmi8ksvG5CAs9p1CTlp1CerHZ/Qs:c4QVvnn78kYG5CAs9p8lpprHZt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783245444, "uuid": "6947e13b-cda6-4dae-ac6f-afc41a84b5d2", "value": 4327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783245444, "uuid": "92416beb-db80-467d-99d9-b4fef53e4354", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783245444, "uuid": "a9171d2a-b91a-4852-959e-9c7045f15cc9", "value": "unnamed-artifact-line1-2.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6e2591-78a2-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783277472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277472, "uuid": "91e9549e-d827-4329-bda5-9c12122abff5", "comment": "Malware payload (Mirai)", "value": "19c22499df6f5ae17ee674bb3de9355e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277472, "uuid": "7ad323b6-9ea8-40a0-b455-2d36c5265e33", "comment": "Malware payload (Mirai)", "value": "ff1b92ad94b4db6f68de23a9050b3115a65c7e0d59de6ac1df12d34444cbc749", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277472, "uuid": "86d94e13-b2a5-4fd6-bb37-e5d849cb8315", "comment": "Malware payload (Mirai)", "value": "207b65d91a43148150c5ae5849fd3c91e2f3f69c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783277472, "uuid": "4d688ae4-3412-44dc-9881-fe243589d278", "comment": "Malware payload (Mirai)", "value": "5cfa9a4d8a2c26e2733a2eedd5a11c19cecaf6cc26ba15591bd893199fbbff0cd54741fcebe43214b52a2e5845d4d2ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277472, "uuid": "3ed56966-bd51-448f-8243-b8dc1901af27", "value": "T15D836CC4EA83D4F5FD2209310173BB379AB3E53E216ADA87C368A566EC125C2E51635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277472, "uuid": "7faa3d35-9d3b-4e13-9099-dd828a90fbf0", "value": "1536:UbioFQZkyTl6urYwfaA078Glr4qm+WGy4NawvVcS0wIl:UeoFePTFPfN0gGVFMYaZwIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783277472, "uuid": "8f6e43d9-625d-4133-ab96-3e5ce17e5f0a", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783277472, "uuid": "d2912175-b4da-403e-abb4-6aae3f88b632", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783277472, "uuid": "5dc0c6a1-c68c-4795-a621-49a18489b04c", "value": "ohshit.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70febfa6-7883-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783264135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264135, "uuid": "7beac73f-b0f5-4a26-a9db-fd5ea0059973", "comment": "Malware payload", "value": "b3d1f6e95c0df9694f69abbcc9f56b33", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264135, "uuid": "e5cb3679-00db-4cc3-bb75-9cf22dfb1343", "comment": "Malware payload", "value": "ff4aea13147f2c17b66f530162a69972f41b4f8b9261e817322d7f310fb02fb8", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264135, "uuid": "2f251849-1531-430a-91d1-1e35395e6b50", "comment": "Malware payload", "value": "64645057475ce2f3509fb93f07301561a46935c3", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783264135, "uuid": "7fd950c7-a51c-404b-9d5f-06f05db5e0a6", "comment": "Malware payload", "value": "6237f342ddb22f98466f8b87028d39210e92484a4e6eec52d1702075f504e75c81490a9238b3a1299c50b7676c55001f", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264135, "uuid": "42e63819-0783-4edf-82bf-9905fa6e27a4", "value": "T10A95235A42A5D025E4B25334CDF6006A6678FC664F29A7FF27C1B6BE9F336C46032706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264135, "uuid": "e6801514-1d8a-4f56-b810-13300bb159b5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264135, "uuid": "3f32d1e3-0111-43e0-b83f-94d1e43bbe4d", "value": "49152:dui3uIvbwDFvF0sWYZuHoh5rgu7eIPRcjkfyS+Vp:HwD1VZ4mt37e0CIfyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783264135, "uuid": "643cba7b-c378-4491-ae2d-0be67f0fc6b8", "value": 2056192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783264135, "uuid": "8c917375-c841-4ba2-9504-1a21aa543320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783264135, "uuid": "84c1eb1b-4c3d-4e38-97a1-44706f6a9369", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }