{ "Event": { "published": true, "date": "2026-04-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-04-14", "timestamp": 1776211381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1eba7d66-9ae2-490d-94b7-f521fe109449", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c674ed4-37d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776154078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154078, "uuid": "791bf395-8eca-4e68-bfaa-4dc0798c82e6", "comment": "Malware payload (Vidar)", "value": "921e9a06c6e139b1d9abc6f7ae453627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154078, "uuid": "81baf4b9-d723-4332-ad1f-ea7d9c13f315", "comment": "Malware payload (Vidar)", "value": "0150605913e5cc05dbe79ed8f488d58140ac7c2853ca7853a7a78e9885628b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154078, "uuid": "018da00a-6710-4515-af22-7393ddb09719", "comment": "Malware payload (Vidar)", "value": "66f59e37097340dd3fe8639d4ca4c62dbafe1491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154078, "uuid": "400fb394-6a13-470d-a0bf-51f5e7ed3686", "comment": "Malware payload (Vidar)", "value": "4bf6d9f52464a25792c6458202d7329928edebf4fd130e7c558d179d1c79e6c50381f13b3b046a7c28622d5ca867e1a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154078, "uuid": "3feb6ad8-24e2-4f5c-9da8-bb197f56c6cb", "value": "T14DC58D0B6C9545FAC8AA973588B752A17B70B8090B3233D72EA27B383F727E15D35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154078, "uuid": "ef4c5ccb-cf4b-4659-a2dc-ba98fc2914d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154078, "uuid": "1c08637d-01de-4e4e-818b-23235a6ba374", "value": "49152:YF8Cb6nYXzguOQr1ATZToq+3rRgtwuskE+:Yu12UpTuN4wu3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776154078, "uuid": "18282c72-dae2-4a6e-8a97-23673648640c", "value": 2594520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776154078, "uuid": "3147fd24-aa51-4d12-995c-9a1f9b21ac3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154078, "uuid": "e394140a-9d91-4065-b24a-8fb6aeb38346", "value": "op6_final_binary.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764e3fbc-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127197, "uuid": "ebf4653c-9e9a-45cb-bb43-a1286269ff0c", "comment": "Malware payload (Mirai)", "value": "daad0a1adac9bae26c9c69f5b59df455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127197, "uuid": "0466f9a8-2be8-44ca-bd95-2c57b114a50c", "comment": "Malware payload (Mirai)", "value": "01b6d8294a47ba078ffd0e06b520879ea993d2417c6f2210862d1751714a5028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127197, "uuid": "753d7f60-0392-401a-8d6b-758c13f7190f", "comment": "Malware payload (Mirai)", "value": "832529350fcfcdde0e2431fb2b0456291c54be95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127197, "uuid": "a9d00810-f0bf-4176-9981-4beb2103868b", "comment": "Malware payload (Mirai)", "value": "2500c955a41371ec49c8ad2a24901c33267024a268d414949ab737fd8e40a1876e63633332e58742472ad9b68c37b265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127197, "uuid": "4c211efb-43f9-4b28-8c68-40a55b218fff", "value": "T1C7934C03798189FEC49AD2F45BFB6230DD22BC3E067672DD6794BD912A1AD903E18734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127197, "uuid": "1525d7b2-8f4e-47f8-9b2e-a6118fd89507", "value": "1536:apdLZsm1eiVWcuc3U36kqULz1uLxEh3w4zhAUZuo:apdLy435RUn1ulERwuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127197, "uuid": "214db4eb-dc35-4887-9472-5bc7d90e36b2", "value": 95096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127197, "uuid": "a503b254-9c52-4943-bb6d-11619a686953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127197, "uuid": "8a27f60d-2b64-4b33-8b45-307e8b998486", "value": "zyre.x64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01afc99d-381f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776184124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184124, "uuid": "46a86604-de5e-4a52-9e8d-1436c4b3f0e4", "comment": "Malware payload (Mirai)", "value": "d74935514f5140ce485e006641079ef7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184124, "uuid": "afc5a5b9-8aac-4d5d-9ae5-f03a733cffdb", "comment": "Malware payload (Mirai)", "value": "03e1b6f6986ba888fc0921c901e7fe5524da0a0dfc818d0ce697e8485216843a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184124, "uuid": "ae498751-1a36-4627-9356-7ea3f32e4d06", "comment": "Malware payload (Mirai)", "value": "b586a654750d153dd3ee107753d2d81f42de044b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184124, "uuid": "5a4fdae3-81c7-4219-842e-f0286826b5c6", "comment": "Malware payload (Mirai)", "value": "e39e2b091bd844ca94aef3f3f639a9064621b5e3bf4beff16d7a9ee7c7a4d1fb931d48c4b5b803f09e0856f730f7bdf0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184124, "uuid": "bb7a0533-0f9a-4c0d-8d90-6eb328ec24bc", "value": "T1C1931981BD92A62FC1E013BAB67E518C336677B4C2DF321BC8214B61778951F0E67B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184124, "uuid": "917ceb5e-d96c-4eb2-b028-eeb111f2272e", "value": "1536:uMdHpEX1wloSHRQ4TRB5u1K5UU6CZAVY6YP+0760RRLA8vVN8m3E+v922Xndq0Xx:hdHpE8oSHtdHZmzolN/Vnce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184124, "uuid": "9f9f5414-34c3-4482-8958-b64b4149d36c", "value": 95796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184124, "uuid": "7f76ffde-abd6-43a9-8322-7bc55174ae07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184124, "uuid": "bd7bd245-92f6-4393-a83a-d8f8d93a7c22", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774a4c20-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776164994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164994, "uuid": "565f9a6e-07cc-4f50-b6d5-b77ed5225a67", "comment": "Malware payload (AgentTesla)", "value": "6d962ffb02376ad09ba6c77f36c75581", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164994, "uuid": "8daffd86-22f6-4a1b-a380-240b28245640", "comment": "Malware payload (AgentTesla)", "value": "0473d5c52ecebd5b343b745f86e7ba8d8a6d35376ac1b7600c5b1ec7fc35e1f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164994, "uuid": "c781897a-0c67-4413-b57e-11aeccee1b45", "comment": "Malware payload (AgentTesla)", "value": "f3723f5818ded25a47074dc72cc68f788ff5dd29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164994, "uuid": "cc40414a-4eac-426b-a442-62f08f0f3c5d", "comment": "Malware payload (AgentTesla)", "value": "979749acaa09f91c51cecb8f9e9131fd9cddb489f637e2212c1b855ed7d274ddaf560d7339ae869ca5cb8a5262e645f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164994, "uuid": "98da9ff0-f79b-4d4e-8182-64a12a88bd1a", "value": "T11F65F21145C83FF9CF6C261D50BF260EA3B14D8A641AA945EB73BD4BFFEB600521B099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164994, "uuid": "fc5aa4e2-776d-4e4f-a7b7-230addb5cbf4", "value": "24576:lbJTdwtrsziV9liVsEqFFPgINGLnG9CEifCVMcY8Jf2o5c+Rt:twE+Eq7Pd2n0tJLHcCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164994, "uuid": "9f2f2e05-0a45-4b34-8c25-04e56c83d7a6", "value": 1432571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164994, "uuid": "cac908dd-c530-4e9b-a07e-7334d03724f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164994, "uuid": "7ae944d6-c153-479b-8d55-9bb15b66d6d6", "value": "NOVA COMANDA 79862.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffda9717-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776149762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149762, "uuid": "aaa0692d-e48b-49ab-858e-dc1a75180ca0", "comment": "Malware payload (Formbook)", "value": "8251db416a3e8613c0e3b81a9e2a91ca", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149762, "uuid": "9e21d817-d36a-4f7a-b106-d5d47728bad0", "comment": "Malware payload (Formbook)", "value": "050c3d865ba81f24d449fbdf17fa8a74b99988043878cde345b1960bf2be0161", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149762, "uuid": "5f61f443-4c28-4c27-b94a-82b8948e5518", "comment": "Malware payload (Formbook)", "value": "26566c79779aa895508ea0be0e004bfe767cba5e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149762, "uuid": "539b565a-c8a3-4c6e-a7a4-757ee6e044c0", "comment": "Malware payload (Formbook)", "value": "d37ab6767f0aa96b871e308b6504e3d07a84ff709151ffdacea40c916f598be4d074bb47a97070a2c12a856bfba2c18c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149762, "uuid": "883de179-911c-474c-85be-e21676245c35", "value": "T1BC95021149C83FF9CFAC161D40FE160EA3B14D8E511AA949EB33BD4BEFAB604521B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149762, "uuid": "07a89afc-8694-4033-afcd-de1079ada59c", "value": "24576:RyncTreSi2NS4jhL7VVwPlk4flv7dzLe2+fAuD8wdmPfG3fPUet:vzia/PAVthWAuTnxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149762, "uuid": "752ba77e-a9fa-4fa6-a2a6-7c12f685874f", "value": 2046491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149762, "uuid": "710ce986-ded6-4a08-85f3-f63027c5edda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149762, "uuid": "7c81b58f-5873-4f21-bdd0-3a044f6a7bc3", "value": "Request for offer #046903.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f53e56-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144564, "uuid": "095801a3-58e9-4144-9114-73d5f29881ef", "comment": "Malware payload (Mirai)", "value": "79e45c39dccae4678d499201ef1c721b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144564, "uuid": "bfbc1dbb-bcfd-4665-97d0-faefb50564c2", "comment": "Malware payload (Mirai)", "value": "05120b5de2948f2307d9510778d7c7824b2ceee31a37daa253adc14dbf6b7caf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144564, "uuid": "b4c6ee8e-8a54-4e32-a198-bffaf0636009", "comment": "Malware payload (Mirai)", "value": "c24c40b0aac88868d7ef34cd6984f8f82e6383a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144564, "uuid": "a8249eb9-1600-446b-bf5a-623112b64cf8", "comment": "Malware payload (Mirai)", "value": "5019562471dd6a5b29f5d123665dc95d939d14c4a11df5e59a0c18e785f6be77ea9c48035877c0196046981462af5fb0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144564, "uuid": "6b514560-7d01-4cd1-901a-5d46fec9b4cb", "value": "T10E63AE67C96A6E48C05941B0B570CF781733F044825B5FFB9A96CA698047FACFA097F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144564, "uuid": "7060437a-1210-4902-a3ad-92611a065f7c", "value": "1536:cavlbE/MtCXcvVeYkI07WKDDk77dhVvZcC0/kHDc:ccVEUthrFSpDirVvZcMHg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144564, "uuid": "b8070dda-b032-4c75-8ce8-d7ba69d73e44", "value": 67608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144564, "uuid": "f2e3f056-0db0-4e2d-9b07-da7393203605", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144564, "uuid": "85eee1de-c30d-409f-89ee-d3f490ff8028", "value": "Josho.sh4k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36aab2b0-3852-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776206118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206118, "uuid": "81055988-530f-40b3-b44d-87e5167449fb", "comment": "Malware payload (AsyncRAT)", "value": "166537ad686bc0bb77232a2116ab18ec", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206118, "uuid": "2a0a85bf-3bd8-4d87-8fc3-db1b0506fd65", "comment": "Malware payload (AsyncRAT)", "value": "053af08724cc5542c0f205c40ee6312c9dda890af51926b340c31e9b25e02c13", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206118, "uuid": "4623ca09-f45f-44df-a8c0-0390fb2f2be1", "comment": "Malware payload (AsyncRAT)", "value": "3f73ac16f271d471c97fef15b7ddfeec58136913", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206118, "uuid": "0a8e9413-b89b-401a-855d-d51c57c9f2a7", "comment": "Malware payload (AsyncRAT)", "value": "792960ed51c9e531d3b95dd753cd2d15b67768fdf60709e9464be1bb638285024a52c33f65a401744cf1c7c96fa433db", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206118, "uuid": "11d928f9-09b6-48ca-8316-6304e8a3fe53", "value": "T181459D0273D1C026FF93A5723D5FE7264AB96DEA0223956F13C81EB5F9702A04A1D673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206118, "uuid": "c30d3861-7a39-4944-ba65-36f8f3f8041b", "value": "a54cded501cc15537b258370981a6f1e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206118, "uuid": "3b221da1-0429-4fcc-8486-559c09608f18", "value": "24576:FIAKT09SUTPSmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBHf:FIAKTe27kpRA4R1oGDVeQXsrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776206118, "uuid": "d3e682b4-300c-4bd2-b16f-cadde37d7e6b", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776206118, "uuid": "3c329728-c8a7-43ba-9f83-d5282cb1f908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206118, "uuid": "0ec2d391-61a5-4531-bcef-e91a5bd070e6", "value": "166537ad686bc0bb77232a2116ab18ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80295aa8-3804-11f1-a769-42010a9c0008", "comment": "Malware payload (VENON)", "timestamp": 1776172740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172740, "uuid": "633a11c4-9ee4-44c6-a831-9f0889d86713", "comment": "Malware payload (VENON)", "value": "b77129f1f2de5cbac7e6d03d6c7f0804", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172740, "uuid": "a8c74873-bc1c-4a4d-b21d-00e7b6c2a7b1", "comment": "Malware payload (VENON)", "value": "055bdccb6e76c198400455552b8f4ea09414f6710d3857122a532dd5530adafd", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172740, "uuid": "e2e54757-5610-4449-919f-a03f1a7a2733", "comment": "Malware payload (VENON)", "value": "252bbf98d91965eb1e4ae52c574588c8c61d6bf8", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172740, "uuid": "70a64937-0c83-4461-8fea-1a8e69389fc8", "comment": "Malware payload (VENON)", "value": "e29213e705b25aeddc841d738910c0fc8f4651fe891f18624076398d4cd78f53288b8b90fe8d1ace96ed0178526e0014", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172740, "uuid": "eaec7065-7540-4059-a8eb-45e6edd43104", "value": "T1AB968C83E2A251E8C57AC175CA5A6633BB31384C47B067E767805BA22F71FE07A3D744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172740, "uuid": "dc8abb52-18b9-42fd-898c-0a5889c605b8", "value": "a1c6db5d71242693a83798289bc0fb12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172740, "uuid": "a949a24a-7bb9-463e-88ba-948c8f7f3934", "value": "98304:T7s9psq7qzO++lomfEx03o0laltZg6Y0rb85TkEhU84+hUFn6fdn0n+6zU:vs9vK8l9/lOq6+zU84AA6Fn6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172740, "uuid": "c3f0f70f-ffca-4d4a-931e-c85136cfc790", "value": 8976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172740, "uuid": "52d5d143-39b0-4c0f-9e2a-deee8a6048d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172740, "uuid": "3357fe55-7980-46b4-96a4-a0519018ea4c", "value": "SSEdevice.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65e219-37f9-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776167875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167875, "uuid": "18950ff2-5c0c-4b4a-aa97-b3f59e99d840", "comment": "Malware payload (ValleyRAT)", "value": "e8da491482c093261e03b68c2b6bde4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167875, "uuid": "7f2c1ab7-ec00-4d90-ab9a-e8d5dc85b81b", "comment": "Malware payload (ValleyRAT)", "value": "07777df44654c84f4cf407d3338189d1c25e5e9f52d1df7c7603b430d7fc18f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167875, "uuid": "cae71c26-fbf9-430b-a4e0-8ccd7c408874", "comment": "Malware payload (ValleyRAT)", "value": "87b77d4e3285fa254ff4d76d1bff9839ff609311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167875, "uuid": "ba3465bc-cc34-4fdd-852e-d2bce845db5a", "comment": "Malware payload (ValleyRAT)", "value": "9df484bbda30ba7d379ccf73ae97ae0d763e5dfc175ae08e7eb001db36f3ecf1305f9b7d02d13599e318033101963c83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167875, "uuid": "b245e002-fbf3-4122-b767-d7c229645ab4", "value": "T172346C15FA958DFCF95BC0B8824689326E7678880711FAFF469416343E57EE23F78218", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167875, "uuid": "735c8024-21ad-43a7-9e30-7ec271578753", "value": "38d73c3438cb10338a7b3f92274b61a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167875, "uuid": "8ace5ae6-8a19-474d-9522-c897c4b0d3d4", "value": "3072:Q7PG7zBHuUVQnyYfmZ2vdY5QiGhjti7m5UJJWmgBlrrenGXHa9redIg:QbGBFuHmovdHjgSWJIpB5WGKsdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776167875, "uuid": "1e5e31f7-61e2-4b4b-beb8-9f6d6a30eb2b", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776167875, "uuid": "778f145e-4d38-4e12-b9dc-84c231343ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167875, "uuid": "d682fcae-77e0-4e7d-a9c2-6eb6adc6f842", "value": "2026\u5e74\u7b2c\u4e00\u5b63\u5ea6\u8fdd\u89c4\u4e71\u7eaa\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2c5eca-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776165033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165033, "uuid": "49460ec5-f2e6-46bb-af01-09e4b907dcc2", "comment": "Malware payload", "value": "a4e848b37775177e8f40b5e92a8221a3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165033, "uuid": "041a1919-73cc-45c2-8de7-2cc45647f538", "comment": "Malware payload", "value": "0863c69d146a9d75af65943bd3fca924e1ab5ec30f39bdc47ef693b35d8ea325", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165033, "uuid": "26bac24d-21e0-471f-8bd9-982e7092f0f1", "comment": "Malware payload", "value": "8c9520ee808958ade2e41bb71610ef17db5b16ce", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165033, "uuid": "695fa75f-696e-4131-9e9f-a72678850df9", "comment": "Malware payload", "value": "ad37f337c87e3644a922d345ee4499e2693700cdaa324f6105f27c5d371e83060233a6f316076257a6f94aae31e6982d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165033, "uuid": "286ed78e-69f7-40d2-bdb5-4764c550da01", "value": "T19D31DF252AE41B1AC3B78E3B14FBF240A6247A12E953CFAD41D042CC1CA9615F47ED7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165033, "uuid": "44803a4c-9c8b-4f0c-853e-2c537747a50d", "value": "24:89lWkwrf5j/YLsuUZ+/epe8L9EY4I0WCoXQaR3+habsliXOHxCGO+/efm:89Yld8sueLL9EnIUoXv3KaIl8uvO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165033, "uuid": "e6e1b06b-ac9f-45bf-97f3-5c6005825406", "value": 1448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165033, "uuid": "f603c864-ee5d-43d9-84c7-072242acf955", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165033, "uuid": "3c8869f0-f482-4478-b3e1-63af78de9722", "value": "document_A4.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832d00d2-3809-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776174893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174893, "uuid": "763d9758-a67d-48e4-82c9-2cd85578c17b", "comment": "Malware payload (LummaStealer)", "value": "540e29af572831c2f3297ef63cfd9d4c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4553", "colour": "#47C198", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174893, "uuid": "16aa6c5b-7b76-4f9b-9b0b-36f24ff12923", "comment": "Malware payload (LummaStealer)", "value": "088adb8c250ee9b65d6192cd5b88e2b22f5e61c979504f4bb0e59a8f8b77b308", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4553", "colour": "#47C198", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174893, "uuid": "29a9921f-845d-44a0-b41c-7420fdbb884d", "comment": "Malware payload (LummaStealer)", "value": "d43ace373e2e4492fc8ecb0c1dda8b4f961d6a27", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4553", "colour": "#47C198", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174893, "uuid": "d79637ee-0ec7-4997-bcc3-1e65b2f949db", "comment": "Malware payload (LummaStealer)", "value": "a41e6e58154b90ae477efb45ba8865030a1e807c438f8524bf6ec0c0debf762161ff48c5abbbf8f445d6dada332c2198", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4553", "colour": "#47C198", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174893, "uuid": "f32e883d-abd8-4546-8d39-d3a0cc67c593", "value": "T1B1063373682517B94C75672B8AFB60673F45B548C90B3A24FF0698E1C2D2B219E1C26F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174893, "uuid": "96a4c22c-a5bc-4916-aa90-befda21ffa07", "value": "98304:9qVStCKgLPyF9nZS2aC3z0wR+Rp6pa5ZOpyuq:KSwBPyFtZS253IwR+RMa5ZOFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174893, "uuid": "243ca106-e906-407f-b46d-12e802fa9ac7", "value": 3980403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174893, "uuid": "b800e744-5f7a-4cda-89ad-3bdcfb4d42df", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174893, "uuid": "1a6d0ef9-2431-42c2-a83a-cc045e47a302", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3531db2a-383b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776196237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196237, "uuid": "16c60ecf-5970-41cb-bfe8-9973a1efbb97", "comment": "Malware payload", "value": "22e0cb8b501016fb2e11e777112a3fc7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196237, "uuid": "23c288cb-1b27-4e9c-b39f-a3569229330c", "comment": "Malware payload", "value": "091286d98a3737589d489e9990a1ae4aab071f16a6c1849155a95a071a52e6fd", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196237, "uuid": "4f1eb669-e38c-4985-9f70-3304505bfb8a", "comment": "Malware payload", "value": "3a6b28cf874cb01fb158e67ccf659243ced238d7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196237, "uuid": "f0c57035-3515-4a86-9f34-b7aa5854efbe", "comment": "Malware payload", "value": "a4c3e97b75ee235161fa8378b11d0706b00f0c841eb62462909f3460cb4db1717a1975b6ccc80e00a075e62b4eb3c329", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196237, "uuid": "d84d6cd2-9ab7-471f-958d-740676e764ac", "value": "T17D41E302A2125AF578CD48E84D8BE410474E03D38A5E3566FD7DA5683F7830DB2B5775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196237, "uuid": "d0d1da78-4127-419f-857b-c0ae31b8df49", "value": "24:ZvePYIEteYF0sBHhaLAj7QvGu6DSmpc5/9IojZ5Dmgv8/hKkh1/t/MXngVl36:ZvKYIEiYXKiu5/9tX70/Z1/t/MXniE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776196237, "uuid": "0a758b2e-a5a3-4886-92cd-a3a4a9e62ec9", "value": 2209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776196237, "uuid": "9ea2262c-b0a4-4cf1-aeb8-a03c3fb6c620", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196237, "uuid": "8479bafb-b9bf-4d38-9755-4966af308b16", "value": "adb2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ead9964-3811-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776178294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178294, "uuid": "ca99c591-ce45-4aad-bf5f-ed5a252640bf", "comment": "Malware payload", "value": "9a54831565c21899544304d895fc93f8", "object_relation": "md5", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178294, "uuid": "a3b63438-8634-4f5a-9730-6fcdaa620281", "comment": "Malware payload", "value": "0a0ad2600479ce186e6784f66135d648ea0ba1eb35813a4f9c84b461e78c15fa", "object_relation": "sha256", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178294, "uuid": "455a676c-5095-41cd-bf9a-802afdb6c551", "comment": "Malware payload", "value": "66046d89d9d92c651dbf605a3d3828d74b06f53d", "object_relation": "sha1", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178294, "uuid": "3015a533-c866-4c4e-9ac9-60c8fed9dc64", "comment": "Malware payload", "value": "128576b82bce5ea9045c91f436fb1069221b3038bc195f290058a13586ce7ef969a6fcf09dff1593d6ad4a3bcd8d0203", "object_relation": "sha3-384", "Tag": [ { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178294, "uuid": "98ad3e34-e390-44d8-b8ce-33cceeb16745", "value": "T1EC663333F5381EC4D83BD17EA0A316D283E2220DE043D87E56D56DD872D5B8A588E96F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178294, "uuid": "12ec5217-4980-49c0-b416-3c897985ff36", "value": "196608:+Zftw25hVUSGkeYGBq0uU+HB/OGUElH6XU8YYlbHXUZ:+Br+TBqrU+h/PUEl0U8YYlbEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178294, "uuid": "0c19745b-b00d-4116-989f-c4b2d7265b11", "value": 6860401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178294, "uuid": "8b1f20b1-3e4f-4f10-82a5-4bad335277ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178294, "uuid": "38376672-fefc-42b2-b51c-829ce2a2d6e5", "value": "insureongo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a50e793-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162422, "uuid": "65f30593-553f-4446-8fbc-a41130fb4fcf", "comment": "Malware payload (Tofsee)", "value": "084184e0c6be92913866512115001a0d", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162422, "uuid": "a100f1df-6ce3-4b78-a645-45badc9bc581", "comment": "Malware payload (Tofsee)", "value": "0b7b4fd53094062f72c6fe5c3aa7dfbff84c336690fee1ae5b15b98d1db8677d", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162422, "uuid": "4a0e28d5-8692-415d-8518-23d99451f578", "comment": "Malware payload (Tofsee)", "value": "353bd44ed2de68563a77e789dbab67174315bb5d", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162422, "uuid": "00a2f62a-c1a4-4476-8ed1-6e0afd617e33", "comment": "Malware payload (Tofsee)", "value": "e4617984866a58b8004d198935ed59a3eee9e7e1de1cf13b30ff87d8233c3d054e2ab0cbe7da0dd994afd0e87846bb60", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162422, "uuid": "3f336257-9a2d-4f69-9b32-89870230e31a", "value": "T157C674E715DC49DBE48A1B7C24B26A2BCD90FB74443A152225C4E9CF1E8EDDB065C3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162422, "uuid": "e0bd7760-b992-417c-b8c6-68a1ea5a27e9", "value": "bd9bc8fb21d905f25fa2eb24b49500b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162422, "uuid": "48fb61d3-6c63-4759-b192-06c7f8213159", "value": "6144:ZB+Xj/mRJFhaDgVeAB7CZAzqaj3TJ4JfJ/J6J/JEJtJ/JEJ8J/JEJnJ/JEJRJ/J4:Zo7mRvhY6eAvuaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162422, "uuid": "dd6262d8-ddfa-4f34-8e8a-9a26dca5ef86", "value": 12599808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162422, "uuid": "ff4b6db8-4110-418a-817f-62f9269ccdaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162422, "uuid": "4047f2f9-4540-4f56-bce3-8a6d1404db59", "value": "0b7b4fd53094062f72c6fe5c3aa7dfbff84c336690fee1ae5b15b98d1db8677d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bb843b-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144570, "uuid": "e668dc20-d095-4649-883b-b34caca43c58", "comment": "Malware payload (Mirai)", "value": "b561ba4d502842997a89274a9c3dcbc4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144570, "uuid": "4917df06-5842-4a44-b73a-9aa6031cbcb7", "comment": "Malware payload (Mirai)", "value": "0d38406d1f143c4d2095a5d865b8c740a4f1c0224ad3187c7c6f918722fae26e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144570, "uuid": "41cc502a-de2c-432c-8edf-7089a6ccea85", "comment": "Malware payload (Mirai)", "value": "566a69c52e5bc6879af8b6409bb13c2e5feabb53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144570, "uuid": "0822ecfb-d48c-4735-af8e-bed297e1007a", "comment": "Malware payload (Mirai)", "value": "4de52191f9bffe795f09d37f0865ea57df159ecf222a166f42cbd9213dff9a97121e8e0fde3efe3525fae8b9a76a64ed", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144570, "uuid": "fdfc9656-d347-4fe0-a031-3d640e45a570", "value": "T108832956B8819B11C5C512BAFE2E118E331717BCE3DE72129D24AF2077CB96B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144570, "uuid": "1740422f-13b7-441b-9bb1-710ae66180f6", "value": "1536:j6nJMte+LfqwGKQ71iCgK4LkATT5TshT8zaB/eESQtM2i+a0OO5kYqg:sIeufqwGKQ1N44A5ET8zaBTa0OOak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144570, "uuid": "44934c7a-861c-433f-a88d-b80b5c55448a", "value": 83980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144570, "uuid": "ecadc097-b1cb-4797-b34f-745a0591bb88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144570, "uuid": "e5d38e79-fb0b-4856-93fc-67122f43becf", "value": "kkk.arm6k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9599a16f-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130685, "uuid": "3d534b69-4962-4bf3-8614-d172e2d1a310", "comment": "Malware payload (Mirai)", "value": "13d138b5bf79b0d3306f5d71985c94ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130685, "uuid": "2d8dc617-6344-43bd-a0be-ecd0bc1494b9", "comment": "Malware payload (Mirai)", "value": "0de810d1dfbdc4fdd79df55bbde0a8693f601a218aaadbb80ab8f89d59b4091e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130685, "uuid": "7c169245-7690-40c2-9a78-afba78c0fb51", "comment": "Malware payload (Mirai)", "value": "c63497da5117917fdca45301fd5e043f049c7d1c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130685, "uuid": "ff64e4ab-b4e2-4a65-90ca-9a73bab2d5ed", "comment": "Malware payload (Mirai)", "value": "624bcef7017ec58c29f753fd7ec953bbba7e6f7777622364553f6ab78f234b5d20f80ce7fd5c86a98c609a3826d56938", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130685, "uuid": "c1814b21-2cdb-4ae9-bb70-2cad184aa6a9", "value": "T17343971E2E619FFCFBAD863587F39E219648339226E1C584E15CDA011E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130685, "uuid": "5cfb72ba-d687-4de8-9011-501e98a665b9", "value": "768:TDul5U9mAG5Y2zrEI/fEInwa05zNx8jMyOFy26Oybb3Hxp2gnAOxAWsFnkPDQI:Y5smAG59zRqn5zNKlbb3HITCQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130685, "uuid": "6cea8313-13ce-4399-bc37-876ad2627940", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130685, "uuid": "dfdac6cc-af50-46e6-a310-59f2603cd808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130685, "uuid": "232a9c75-3608-4d7c-8b4f-64c57f605ccc", "value": "0upmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a2c500-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776195531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195531, "uuid": "70ac3eaa-bd79-4cd7-ae3a-ca9ed4c0d803", "comment": "Malware payload (AsyncRAT)", "value": "278d7b5346f2d90f97ce1af2a287fc10", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195531, "uuid": "27e753d1-aacf-4c6f-b8e2-3ab6fd02ff95", "comment": "Malware payload (AsyncRAT)", "value": "0e794ed2362dd814dba0834d9cfdce7642ba018c00f415bbb95292ffde330aa0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195531, "uuid": "34880e3c-fa68-49e4-80b8-778ef59c82e1", "comment": "Malware payload (AsyncRAT)", "value": "3c37d026683c602fec567c353e933c1877c8d74b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195531, "uuid": "ac6bcaf3-f843-4520-b7e8-d5688f60ffcc", "comment": "Malware payload (AsyncRAT)", "value": "171ff8c6303c07bf8fe12f301e52cfecd245197e06e795019cb53a5fcd5473ab4a4621bddb8e9cf8f8fc3a98c9c85551", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195531, "uuid": "5cd93046-ce02-4fda-a517-37566381bb87", "value": "T12E232C0037E8812BF2BE5F78A8F26145867BF2633603D54A1CC451DB5613FC69A53AED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195531, "uuid": "d63dacbb-c3ce-4b0f-a780-7c151d0cfe50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195531, "uuid": "2a88a983-7d17-4a70-9930-93ad2c5c2696", "value": "768:yuKQ9TH4EjZWUR/ejmo2qrThkTHJNOPIchzjbagV3iaFIMNNEIq9rHBDZ7x:yuKQ9THfe2FLH3ch3bNVSUJkIKhd7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195531, "uuid": "21fa2cce-77dc-4e74-9f73-56d0fd6b6e11", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195531, "uuid": "288fb4bc-8861-423f-9e24-ed1b2ce02e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195531, "uuid": "0956a00e-d7ad-420f-8956-b97da8f91150", "value": "278d7b5346f2d90f97ce1af2a287fc10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dee8aa-37d8-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776153711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153711, "uuid": "578622fb-649a-48f6-9d12-554f89a703ff", "comment": "Malware payload (RemcosRAT)", "value": "9ca004788dfd2fb17416ec00d5414148", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153711, "uuid": "166f45b0-75a3-4091-aef7-3565a2abe249", "comment": "Malware payload (RemcosRAT)", "value": "0eaa4f2b818c69f113d4b98d4840c827c76a407fed4653c5f9b8114c7d815261", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153711, "uuid": "b0571d9b-ce01-47ed-ad52-07f674c69d8c", "comment": "Malware payload (RemcosRAT)", "value": "36a59ee95b339f46a5a511faf3b487ca927fa985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153711, "uuid": "71eb0212-8467-47cd-8b8d-8fd895aaf70d", "comment": "Malware payload (RemcosRAT)", "value": "600801c03fbe87491463d8ac14012ba760cbb75dea854eb5d952f42de6a217cedba7ed558fe5541d17e865f3186b6547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153711, "uuid": "674fbd35-2f10-44b9-a6e7-d0a8ebe2b217", "value": "T1073523D1628DE0DBD1880F71DCF239FA84E5AE54F43A81173A90BE35F9769C8190A52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153711, "uuid": "9503eaeb-58cb-4e25-aabc-e34c16bbf1a6", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153711, "uuid": "c99cc2a3-644a-459e-8e11-79f754a87041", "value": "24576:twROelzNcfQnFfXgGuaBvyc9IJl5+bPYl5cbwmDO01SMQVx0:mgelZGCFPuQyc9IDKPYAbwmC0u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776153711, "uuid": "68a520b9-bc8c-4e14-8d24-07dbefa253bd", "value": 1128880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776153711, "uuid": "4b4c155f-d98e-448e-9ebc-93674c08dc78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153711, "uuid": "aa1681f1-fa4e-42c4-8fef-b7caec211e63", "value": "Bestellung 24021625.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbf3f13-37cf-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776149788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149788, "uuid": "146cbf24-a49c-43de-8e8a-f9d99ad01202", "comment": "Malware payload (AsyncRAT)", "value": "2c63cb17c26c9aa10a39ab8f1a75f7a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149788, "uuid": "28bbc3b2-31c5-4b49-af3e-820ff6a7264d", "comment": "Malware payload (AsyncRAT)", "value": "11c5785562293d1e7f1a9148fe250b19ce61f2095e68ef70d3ccd26d05da230c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149788, "uuid": "b71b7415-cc86-46fd-8176-11385e76b808", "comment": "Malware payload (AsyncRAT)", "value": "3b2f8c0747cd049810084f0e6061c45c98843090", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149788, "uuid": "b682d375-8ef0-4f97-8486-24bc8deda6c0", "comment": "Malware payload (AsyncRAT)", "value": "cd1adb6885ca5ac1698b2aff55209151944a2bd48ae982d7369edb4713e2bc24b0aa32f24ebdcc29aaba624b0044f1f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149788, "uuid": "310aa9e9-4f72-4a74-84c7-cd5ad7138ea1", "value": "T180E4AE691EFB408EF16245B841D5673CE7FED2F52D96C783AA3908BDDE16E88AD41C00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149788, "uuid": "2636cea6-7634-4b4e-9a9c-a99a94916385", "value": "ecbae66089398f5b1c2b08a59f81f799", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149788, "uuid": "43b18e62-35d1-434d-8572-ee26453ed769", "value": "12288:7/5wvwWMNnX4nlnnnnnnn3nnndnnnPnnnHnnntnnnNnnnunnn:75onnn3nnndnnnPnnnGnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149788, "uuid": "be67c576-4453-414e-8c0c-21d0ab15cec9", "value": 671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149788, "uuid": "24ea341b-6836-46cc-8bc1-6a997446956d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149788, "uuid": "f374364f-4613-4748-a7a9-28154678cef7", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d841fbf-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127236, "uuid": "f363555c-c1d7-4035-9df5-0915c3f6eab7", "comment": "Malware payload (Mirai)", "value": "95aa7f8cede4d49105ae2c6b531f2835", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127236, "uuid": "163f7cbe-e617-4692-bbdd-c39a57f719e6", "comment": "Malware payload (Mirai)", "value": "12b165ab7840411c1457634b4a73d4c3123de09773b9cae85b9766dc8a1a84b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127236, "uuid": "b16208c4-3bdb-45b3-8c7e-1398c711e4a3", "comment": "Malware payload (Mirai)", "value": "102f847c0f6755dd158e20198bb95bc9616fe79e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127236, "uuid": "b0a55713-f264-4cf4-a7e6-52425ef23dc1", "comment": "Malware payload (Mirai)", "value": "cc5853f6d1ebef38b6f35603992e6174e8a9e9ee17a2f9f9d8ac279d49c4584040fe9d10a492e2252de82589d9524ef2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127236, "uuid": "95c02c18-44c4-4a7d-8b2a-df9bc03ed9a9", "value": "T12BC3188AB9419F02D4D325FAFB9E414933535BB8E3FB3102CE259F64238699B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127236, "uuid": "df5184f4-44c5-43bd-ba87-5b627bd741cb", "value": "3072:7YcpTPxdXMBg/5UVaFAbOJmYmSlXuJdYDhE+fvamCCYH:ja+WVaFoOJmYmSFuJwE+fvamCCYH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127236, "uuid": "7bcef8a7-723d-4425-b728-4ccf0bd9533a", "value": 126412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127236, "uuid": "a8562dcd-31fc-460e-bb43-24c97c7daeac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127236, "uuid": "e1f417b6-6077-4e0e-8cd6-e4cd10cb1947", "value": "zyre.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec37b4-3844-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776200036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200036, "uuid": "ee855448-3ac6-4b20-8e86-a69939fda1ef", "comment": "Malware payload", "value": "f72044c346514c01e42303b0461af269", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200036, "uuid": "9bdfbba9-9cd6-45f2-b52f-dcc423b0d6e8", "comment": "Malware payload", "value": "138a06e4181d214861ac8815473c946ffd9e39fd56ac08fa9e3e122a8b377744", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200036, "uuid": "88003768-2866-428e-82d8-e39689abd673", "comment": "Malware payload", "value": "2485624a0b5baa8b31cf0bd6a58c97f8801d1e89", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200036, "uuid": "a503f43d-4a3c-454d-be27-f9a4598d9d1d", "comment": "Malware payload", "value": "195a1ee0cacbc3d4a7edb1cf40534b181b563deb1bc7e4748ae89a100679602c39144c0dbf4cae77ad6d393bb0833055", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200036, "uuid": "7b841395-1307-4c86-bf99-0b20f2efa5fc", "value": "T17DF73322B0CE8731E5AF90745976DB7991F23DD107B084DB53E4C87B4A3A6C20A76F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200036, "uuid": "2626543f-0a1a-4cbc-967d-95e2f2e7dba0", "value": "1572864:2uBnD/IqC/25jK4vz7cQHsncmTXuLVExV7pGmaHnIE0ae:2SnD/a/Ajxs4AV0mqY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776200036, "uuid": "8319251d-afeb-4ce9-88b6-8d80f53bae08", "value": 72581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776200036, "uuid": "0771b09e-75b1-4ad0-afd1-5562ad2fbc94", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200036, "uuid": "5fb20c51-4a01-4d77-871a-074c91b0a6f4", "value": "win32-chromesog.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45056be-382e-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1776190947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190947, "uuid": "309a98f2-bf1b-4d36-b156-cde9bf6d240d", "comment": "Malware payload (HijackLoader)", "value": "94a73e69344edbebc7cacc85b7e6cc0b", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190947, "uuid": "21f7ac4a-e2ac-4056-ab72-875365580f33", "comment": "Malware payload (HijackLoader)", "value": "164817c6e0c627b23f50fda341eb19050627c2e618b99f1f3feae8c0049addb5", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190947, "uuid": "db3e87e5-b03b-404f-9b5c-befa3e5480bc", "comment": "Malware payload (HijackLoader)", "value": "1e1eb643ec096b3f7a901d37bb5e2ab06b319124", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190947, "uuid": "5ae523e0-61b8-4cd4-a403-4c8b589deb9c", "comment": "Malware payload (HijackLoader)", "value": "dc39804a65e03c512a0d60f2f54b08319fcebb6a070d6368f32f6e9e15c089578e868e1cff54bc8cf4bb51e9f72931de", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190947, "uuid": "eb9b7325-0b8e-4891-94dc-e234735d5d2c", "value": "T154463348178F63546D7799FB2C970CB713A679A54839EEC4200DF6C7908FD32EA82786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190947, "uuid": "49f19c7d-c5cb-475e-a9a9-fc4783d1be21", "value": "98304:6xG6gt0mON9tUaoI3G6t/QMDxwpFnGwotHfVoblq0xSe9DGYRxc6jTbocaCkS4MY:63Jp+IxOGxwnlohfVo00JDGGxcib8C9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190947, "uuid": "695b3b8f-7d93-43ab-9afa-b4a0fcefd9ae", "value": 5620387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190947, "uuid": "7fbcc012-d352-4c44-82a3-04a1f5d00193", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190947, "uuid": "2e4f0953-6615-42cb-9dca-fc56c2914194", "value": "164817c6e0c627b23f50fda341eb19050627c2e618b99f1f3feae8c0049addb5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a88fcd5-37d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776152893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152893, "uuid": "3a29305d-7ab9-4524-9e65-2d116d4a8a8d", "comment": "Malware payload", "value": "6a479b3afe8d737252732bd196410750", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152893, "uuid": "5f30554e-2eec-4fcf-889e-2edfe73f2d14", "comment": "Malware payload", "value": "17fc88213e8ceaaf66e7d8401c673871d55283b5061cb155b4b7266bde32cae3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152893, "uuid": "9d1d8e1c-6553-457e-b5e7-f021cc5d8bdf", "comment": "Malware payload", "value": "9baaaeedcf58ec15bab45d68653886fa7cae3654", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152893, "uuid": "60e74475-c5a2-4d5d-8a68-b25e88593c57", "comment": "Malware payload", "value": "b6614851d6461c306f0b92e61bb3ea2b2bab34a3ed291b896b1515ad32c74c520e842a045d81c43658b2622d3b25c386", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152893, "uuid": "39ff2ead-7b93-4a40-be48-e3cbc1e28de0", "value": "T1D8923A268D470377F0F4017612D669CF8ABA703117A798ABFA4C87E6036295A70F52DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152893, "uuid": "7282fa79-2a3c-495b-a677-1dfa7d872e6f", "value": "aaec64f2ad182e38096da2ef4bc28f41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152893, "uuid": "3bc4e6c2-8c55-431f-99ba-98e04edbb82e", "value": "384:YnHoOOkiHj0wZfCzTlS/w2/T1PZKGPdqt5kPEOfx:QIOkjZfCzTQZPTPAzJox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152893, "uuid": "f3a0de1d-f468-4f8d-8dc7-3ea21d07edee", "value": 21004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152893, "uuid": "7784bef3-b3c9-463e-a4f4-e8d88359224d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152893, "uuid": "9c4123cd-9405-48d2-b41c-3e169db8c2b7", "value": "HYENA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecb3d11-37d1-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776150968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150968, "uuid": "0ced8f71-7c1d-4c07-aa61-903f206a1ee9", "comment": "Malware payload (DCRat)", "value": "1a11225a02d9a5c6daf3a4a4db31ba3e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150968, "uuid": "6d6639dc-7894-47fb-b39b-02b85622de69", "comment": "Malware payload (DCRat)", "value": "1888f46e4b458671359f8006b57d8e2b9fe94c2ce08b8d33f7910947ccf43bb7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150968, "uuid": "fa50b4f5-71e3-417f-851c-bc8132d56c6a", "comment": "Malware payload (DCRat)", "value": "51e7edb547d05662cd425e2a5c02877b3d1a5973", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150968, "uuid": "0161d395-bb1f-4568-ae0c-e11fe8f566b1", "comment": "Malware payload (DCRat)", "value": "d908c276eead7891773daaefcdb65350ff4369da30554c6e8dbe68224d4a05013e17cd0fc111b2b299b18aea390adad9", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150968, "uuid": "477c4d49-e74c-4631-8aae-386f3456a7de", "value": "T1E5758D01BE40CD56E0141633C2FFA78447749A512AA9E71B7DB933AE95213D37C2CEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150968, "uuid": "263868eb-4684-4280-ac1e-bf48394ae263", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150968, "uuid": "44318e33-1017-4b4e-b8a3-791fd7ecc901", "value": "24576:I2G/nvxW3WvUWJopj9CHXePCLx5lqCwqq0zAiRNfqa/zN0VxZ3lRVHtRZ:IbA3O4pjMXSQhN0Ltf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776150968, "uuid": "0d0ab7e6-1d38-4309-a1c0-98cfd53e1e55", "value": 1552985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776150968, "uuid": "4ed19b68-ff44-426f-b751-2684c2cc73da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150968, "uuid": "527f1c61-2f6d-4341-b7c0-c3fe1e6ff162", "value": "1a11225a02d9a5c6daf3a4a4db31ba3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a659dd-37d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776154115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154115, "uuid": "97e76c99-fe76-474d-9d34-6c07bee492a7", "comment": "Malware payload (Vidar)", "value": "8632a6488aff98d89641ffd79bbb7175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154115, "uuid": "6f2f3672-f23a-46d2-9435-06c2bd00f9af", "comment": "Malware payload (Vidar)", "value": "18ac4062d773325076eaea0844bebb295b18100bbb669c351b02ed79354da157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154115, "uuid": "a9d6f226-614a-40b4-9a06-d0cf05374d6e", "comment": "Malware payload (Vidar)", "value": "70f834768ef5ffb208a99e0b78679270ba1087c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154115, "uuid": "0d02fbca-11a4-45e5-bb5f-120dfe172be2", "comment": "Malware payload (Vidar)", "value": "1c4849629edb39edb4b2bc95e0d416185417190a4525f6e58661175b46869e0d57d4bdd72a7f3d533f0f80aa574dd206", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154115, "uuid": "9e3219a7-03a4-4459-a343-1ae359c84e65", "value": "T1B1C59D0B7CD544FAC49AA73588B216A1BB74F8490B3233D32EA1B6782F767E05D38754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154115, "uuid": "713bbade-9ad6-471f-aacd-46ef47a6f63f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154115, "uuid": "f84bf4ff-a191-4971-9e06-43855c524239", "value": "24576:bJq7YTTjgTM78zmt/78VDeloSrAcjoQCGI4CyzVU15Dng5xvJn1SFhheleh29mhs:bE2TcTlzmtD80DjoPuzASxvJn15sDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776154115, "uuid": "df69c1ae-8bc8-4036-88c4-6a8aadb1822d", "value": 2566872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776154115, "uuid": "4f5d5e89-21a6-423e-9626-0474a81e275b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154115, "uuid": "74e74262-010c-4130-b2d2-1cd3da3b6182", "value": "op6_vidar_binary.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b95ee22f-3848-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776202042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202042, "uuid": "7cc53980-72cc-442c-aa78-70e3539cc1a2", "comment": "Malware payload", "value": "33c58fc4f7501d99114c4f9d12aa159b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202042, "uuid": "4959bf16-0b64-4e2f-aa27-9c34606fa612", "comment": "Malware payload", "value": "1951ad17a94781ee11e1c78d02b0df5fd310a923af182a1f3823cdcf6d54a332", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202042, "uuid": "ad3e2e3f-781e-42f4-a5ee-10deb8475d20", "comment": "Malware payload", "value": "3219503aaad40fb882e362ae678c398dadf1cea6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202042, "uuid": "6159ec4e-f93d-4bab-a4b0-084d71bac1d5", "comment": "Malware payload", "value": "d876f08442d64b7ade88a285c6cd3ab55de5dd5d66868d61a99024f72e8ccb85dde85060c74a555d2d91c36fe5a0ddfc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202042, "uuid": "db206123-5a8e-495d-9180-62a3549bbe1d", "value": "T1B1823B0FB9424216D0D200B49676867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202042, "uuid": "36bcfd99-901e-4f5b-9a15-49d9d6a529d7", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202042, "uuid": "1f29e640-a7c5-47ef-a433-8bae055f3fa6", "value": "384:CI78VGQic16wvw077u9NHuagBhav8U9cd:nAU0769uha0Uu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776202042, "uuid": "f100d8e9-5da9-467b-b661-74527f11be3b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776202042, "uuid": "0a366e1e-8912-4e9c-a77a-e183cc6ce9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202042, "uuid": "de6b0968-3efc-4b5b-bd1b-9d3b7caad6d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28abe9e-37d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776151752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151752, "uuid": "c77b23d1-91b6-46e3-a5a0-13530f0c2c40", "comment": "Malware payload", "value": "4e1ba120649f1373133c9a2eab85f83e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151752, "uuid": "1d1748c2-ea3b-44ab-9beb-3964fe03e8eb", "comment": "Malware payload", "value": "1a3a57ffc001e71f1081bbf604b178d8e577144ad92486f14f672e4c3b299083", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151752, "uuid": "7484fae0-0e75-47ea-b60a-5863c1641067", "comment": "Malware payload", "value": "8bc48f5bab2ef2531e4dd15659cde1f555c539db", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151752, "uuid": "d963773b-e855-4f97-b896-1df2d5f868be", "comment": "Malware payload", "value": "4724a9755b1bcb70ea7d9a8fdac555fd1dade07060eaa056c25a4e4927cb27b218df7d07d7b28648ee9d0e99af08a757", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151752, "uuid": "ab5957a2-f6cb-451f-8165-c8a768102c9d", "value": "T1ACC27D62BE94E1785BCF370B76F0F89255747BB2908EA50CA0DE448117DDEE0E63C5A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151752, "uuid": "93dfe78c-357f-42e7-ba97-51740798954d", "value": "384:Q3C0vWvH4FQaFDlOs7VvlPbyR2IDk6jMTICxdU9j74YbI/8a:f0OH4SaFx1NlP62Iw64nxqV4Yc8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776151752, "uuid": "f9accaf6-6d8d-49ad-9f2e-1c4289f2b8fb", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776151752, "uuid": "a7944ede-1432-4457-bc8e-a0f84038086a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151752, "uuid": "ce39b53d-5744-40e8-b060-2f8aa1a67727", "value": "form_91484.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0480b71-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144555, "uuid": "bd6a9a5e-4b54-4358-a152-3cf124e5f7b0", "comment": "Malware payload (Mirai)", "value": "41f5b88252f9f6a041d09b51aca57041", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144555, "uuid": "857e5121-3980-4e12-ac50-35646cf3c59e", "comment": "Malware payload (Mirai)", "value": "1ac49ba73a3d8cb71329424a5fad00f3485094c40d455e0ebb0a55aef42686bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144555, "uuid": "066bedec-80ae-4775-b173-ebd73dd1146b", "comment": "Malware payload (Mirai)", "value": "a353caa28dd663239e259010799357652ba409e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144555, "uuid": "3ae44722-2577-4a92-bac4-bd3cb7b84716", "comment": "Malware payload (Mirai)", "value": "15eb3ab9ac7f96567cd1a529e1e1e31b1bfc9de141b6f2817b6c1c5c2b50e50fb67d9a3c9a9af5acd44f9ca6b847d756", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144555, "uuid": "ecae36b8-3ee7-46fe-9241-bce7178dd5bf", "value": "T127736D91BC929A13C5C1127BFB2F428D372A27A4D2DE3207DE256F21338795B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144555, "uuid": "418b2769-7618-4586-9257-20f14a358ed2", "value": "1536:SK78DNuHVriTUa9jkKpNFQi0rFPPD1O4f1mYqlDvEFc:SKV5qNFQi0r9TXoIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144555, "uuid": "6b4b3ca0-0ead-4eb5-9def-b5462dd648b7", "value": 76912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144555, "uuid": "0c1fe3bf-15e7-40ff-bb7d-235135f0a2f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144555, "uuid": "5730d7d5-3fc9-43a7-80d0-ee810ff6c111", "value": "kkk.arm4k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbd20876-382e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776190986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190986, "uuid": "debc8db1-af33-4c74-8c90-c266ac1c8525", "comment": "Malware payload (SnappyClient)", "value": "cfc5939e9e4b40ff1cdd98cdf9c6bf73", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190986, "uuid": "afa5c77c-3d76-4b92-96c2-18531416b689", "comment": "Malware payload (SnappyClient)", "value": "1b353d150508c8e625d5f461b314951428866f27740eddd5258e42ed0ca17665", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190986, "uuid": "51f76931-4b4a-4cc1-af62-3474b0be407a", "comment": "Malware payload (SnappyClient)", "value": "14b56d790f23666a5a62cc81481b4ab434235a4e", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190986, "uuid": "e0061dee-41b9-4906-b771-c320c1a43816", "comment": "Malware payload (SnappyClient)", "value": "2ec48fb57684d870a27748f1097cf70125c12fc64aec648cbc97b6a1198f96921019e6dc7360ec6f462f78f2fd5fcf20", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190986, "uuid": "5a214432-7c5d-4a2c-8382-7f245e4bca19", "value": "T1AE86336BD6CDF8F174232062F787977600E63DCAEA62C005FAD989A705CD59A4AD430F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190986, "uuid": "c0439d99-a692-4d62-a18b-19e8b3b8153d", "value": "196608:qaZy3B0mOnGEnozK2eO6135X8XPfxtW53rZa4PVfLFX:qaZyxROnGE6DeX65towYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190986, "uuid": "905aa7e3-6a1e-4426-9103-9941ba8055e5", "value": 7955370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190986, "uuid": "4ca3a91c-1c72-4182-9eed-4c7de47c096d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190986, "uuid": "9b698c12-3f19-40e2-b42d-b313db6a8f6b", "value": "1b353d150508c8e625d5f461b314951428866f27740eddd5258e42ed0ca17665.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fff7e9-3838-11f1-a769-42010a9c0008", "comment": "Malware payload (Guildma)", "timestamp": 1776195035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195035, "uuid": "fe4165e7-213a-4120-ade8-d33237bb8431", "comment": "Malware payload (Guildma)", "value": "fcfd4a9f0c3084a2c89a3851f20de140", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195035, "uuid": "d54fc40e-a581-4781-ac61-fc6dedb04d1d", "comment": "Malware payload (Guildma)", "value": "1c436f665f9618e9a01ca3ac1d642defb554c12fa98586d2a744882929cb1182", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195035, "uuid": "5599a0e5-8060-4355-8e4a-8eacdbd6947f", "comment": "Malware payload (Guildma)", "value": "9b2c4c71e0534874fc93c4edd38413f1fd036b56", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195035, "uuid": "ae1aaa36-5cff-4a7d-8ad5-d84ba0e67f3a", "comment": "Malware payload (Guildma)", "value": "8d4663b352e0a045bc81905607082a508f675f67fa29a42668f294c891dcb70410c6959b4adc0714e5137af56fd649ca", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195035, "uuid": "dd99e54e-3b04-464b-84f2-13488ddcbfe6", "value": "T12CF0056E8FD099B5D532557282C859DF572CD12FB1442D2D88E623CD4D73B01ECD670A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195035, "uuid": "cbc44ff7-9816-4594-9f40-7f29b495875e", "value": "12:sg78DaJi5KP7+uEVNvfgcWYk3cHn/9oOtHlIYMZ9y7qK+cUpsn1:s1aJi5f7vIYk3cloWpMjy7qLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195035, "uuid": "ff4b5703-9556-4c26-ae32-c8fd5eedd440", "value": 561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195035, "uuid": "9022e4ab-194b-41e3-a32e-b2ca33bc0360", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195035, "uuid": "a98ff842-148f-44f3-b6bd-d18b63dc1285", "value": "7730f5e319b0042261a99bfdc42a0aef8bc4e35b606a3f6ec8c7f847cda9420e.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587229ab-3828-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776188135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188135, "uuid": "174779f4-a559-4fb0-893f-9ee3468de56d", "comment": "Malware payload (Mirai)", "value": "9fd0a1f3190802adcdb909721ac86650", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188135, "uuid": "3a1efad2-90bc-448e-85f8-c7a81602f4b5", "comment": "Malware payload (Mirai)", "value": "1cc1b9c443c0fea0d8dedca95f19e2249b7d9b659fc5bcf1247a6a6010f68222", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188135, "uuid": "66d8aae0-5d12-47ed-b090-4e39f46f5e58", "comment": "Malware payload (Mirai)", "value": "e29fec9331f6b98bdfa04f39b6a1bac729946df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188135, "uuid": "b3411e18-963b-4fdb-af91-e9219afd2db8", "comment": "Malware payload (Mirai)", "value": "790442ce30079a4db29da8d09683ee7a79b9d065944d80be7412de76d12592b2ba6ea31871ce4073036f5d2a07001891", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188135, "uuid": "3bf41155-9c17-417f-8db5-8fb0da0a38bf", "value": "T18543022839F9D7EEEBB190380D3E65092A09D11D5280866BE8C4775A9785F5ACF287E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188135, "uuid": "f9412497-45b3-4784-acd3-c097edbfc9ae", "value": "1536:arCJE48CE9u7VDxvVzIQQG1cArLkJ6HZtpf621Knouy8Eyd:aX4FEmtSQG40outr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776188135, "uuid": "7b364949-6ed7-4b77-9250-2d6d180d464d", "value": 58488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776188135, "uuid": "9902d79a-6047-42bc-b933-ae82477a1b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188135, "uuid": "94872bb0-7c46-4a6f-a100-50366c1726f1", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4116d863-37c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776144717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144717, "uuid": "71b5d785-8bca-484e-b144-4cf37c8530a3", "comment": "Malware payload", "value": "89f72a7a53440965a0a513c2a2958201", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144717, "uuid": "abc3befe-d8cc-4822-a21b-a72fce3b7d72", "comment": "Malware payload", "value": "1dfc069ec94f6c2e1849ffa0ed080cf8313a2dbdd4d208ba567faa3d26b713c7", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144717, "uuid": "21edade8-f3f8-45a8-b0a3-7259764c7560", "comment": "Malware payload", "value": "66d22e9a48633cf4348980d72d2db02a2b1e71c9", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144717, "uuid": "0ce97f07-c2c0-4925-ad7e-dae6940da781", "comment": "Malware payload", "value": "7424d9b5a430f1af0a2251a06eb6fd75d9a3c7c91d0b0b58b152eed32b52f3fefb9621185124123305d8a87004e8a845", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144717, "uuid": "8a684668-2225-4205-b687-73a537c94847", "value": "T1DDD3D0CB59DAC8F8DF6F6428452E6C02C94FB213165EC580BAEDAF553F11A60B1AF4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144717, "uuid": "7a5537b5-4575-4e75-a46f-ca926265e5a3", "value": "1536:/ue552abGPNenIvGXOjl00SLDzgN5A1ag:VHCgeGXOjl6Cg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144717, "uuid": "fb4ee620-5a09-4dc5-bba6-d164fb747e6e", "value": 134570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144717, "uuid": "058b5859-a405-43c4-8686-5fd2f8800c12", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144717, "uuid": "a320c0c5-4797-497e-b685-72ea14991628", "value": "Local_Edge_Video_688.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11155f5-37e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776158192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158192, "uuid": "992688ce-0511-4ced-8ff5-a3079a31772c", "comment": "Malware payload", "value": "0b29e1f8af09bfb09a839bbd47a18ade", "object_relation": "md5", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158192, "uuid": "be6d5dd6-c8c4-4730-8169-a91f5dc73cb9", "comment": "Malware payload", "value": "1f109b0286a077b19d055383f26aaca3a504dcbec5dd03c26fea952f239603a6", "object_relation": "sha256", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158192, "uuid": "e206f528-d6ce-4523-8b4f-9f97408ed239", "comment": "Malware payload", "value": "88c18b3db3465484a36b21fb377f9120f58b089a", "object_relation": "sha1", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158192, "uuid": "31fc041a-168a-4f31-a715-d2ab31b74e11", "comment": "Malware payload", "value": "53bf3a8f8d786ce504f6a072742c312f8eec1a008991a168ae8fbcffeaf1c5cd7ca3ed1a91cbb78889c0872f85415257", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "dropped", "colour": "#237274", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158192, "uuid": "b6990893-426a-48c0-afeb-2f1856f6c7f4", "value": "T11A2423C94A24FEBDC6D8793EE5548363109C1DE11269886ACCB58169CFFF3950ECF898", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158192, "uuid": "0424cb81-3e36-4212-9808-fed2a834b110", "value": "6144:r89CXW09BRijo2GRZAnOpHnsfOnZqtUwJM7oHBCzvOd:o9CXW7o2DOxsfwwJBhB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158192, "uuid": "6c581dd8-3ea3-4de3-bdaf-314bc9609d3e", "value": 229991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158192, "uuid": "f2d3287f-0ad5-4ab4-8403-5f8776efb636", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158192, "uuid": "c29aeea7-1cbb-439a-bd48-8d8d0b6c30fb", "value": "46.183.222.116.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0873c21a-37fd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776169533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776169533, "uuid": "1b098718-0b52-4316-9422-9d0e6e823aac", "comment": "Malware payload (XWorm)", "value": "642ec70356ff8c5e41db504685450b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776169533, "uuid": "4be7e8b7-b07d-45f7-b3cf-68c591fa06a7", "comment": "Malware payload (XWorm)", "value": "200088491d4bae1446a09224eeb946eab26512b2f18ef2872ba054493c3ac029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776169533, "uuid": "f0a5d9b3-9487-49d0-8f09-2b617ebe2152", "comment": "Malware payload (XWorm)", "value": "3b5fa088f858fa39c5563bb02b1f7f89b4183e5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776169533, "uuid": "27b6475e-c1d4-4391-b5a5-812c5e99e282", "comment": "Malware payload (XWorm)", "value": "36f6d78efb83d12f4157c9d905a8a240d801cff2cb4bfbf01e1b0b43190867b32775ede52dec4bcc91c3681c48c19ba9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776169533, "uuid": "03d60b87-c2e7-450e-bd58-207154a2f24a", "value": "T11FF23A08B7E08261CAEE6FF559B3A1064275A617D913EB4E0CD445EA6F37BC0CE017E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776169533, "uuid": "87de2030-5b85-45cf-89d5-37dd64c87067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776169533, "uuid": "ae988640-9745-48a4-948a-cc73f36d9cca", "value": "768:SSKeaBvJaEDwqjvqEwTsuB9F19DIO/hJ/uCt:+fBvJdZT2TjF19DIO/b2Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776169533, "uuid": "cdd06c22-f909-41fc-9e4d-bb9cd1776b72", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776169533, "uuid": "d158f8ab-8729-4288-b93e-cc85a97528f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776169533, "uuid": "002848b0-3ccc-4a1f-8623-1773977ee9b4", "value": "XWormClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838d4e5-37ee-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776163332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163332, "uuid": "e798245e-1e13-462e-83f0-e8c69dc3bafa", "comment": "Malware payload (OffLoader)", "value": "755d56dcdae7a06d64282a2d77035fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163332, "uuid": "57455ce0-722a-487a-ae13-de2976d02f97", "comment": "Malware payload (OffLoader)", "value": "207aeaef5c6be0b3f94be82655cf1fdc3d7abd261d33ba8509cb52076f0fcfe8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163332, "uuid": "b64a7398-6c8b-4115-834b-0b498155af2d", "comment": "Malware payload (OffLoader)", "value": "fd1f9550f077a4280f13e968ae08e982ab031db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163332, "uuid": "040399ad-27af-4819-b40e-9c877fc08c6a", "comment": "Malware payload (OffLoader)", "value": "565d0c81a5133d292ace474528491c77ee7a1a92ddfdfdfd0bbe9663975ba8be767842e0279633025a52c4c1d7168ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163332, "uuid": "79d06969-d6b6-4265-90a2-5bf0cf475e87", "value": "T1E357232B72C9523FF036963355B6E12018FB764BB0098E16A6D0394DDF2A6D01D6FBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163332, "uuid": "3d42b19c-0a3c-4b84-b86d-1cfebe4731a7", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163332, "uuid": "4d326469-aafa-4f89-8971-4d93af59628f", "value": "196608:Js9k6jzz+YsbaqA3xLSd9zj7TuN5kG5bB2w:Js9kO+EVNSP7+5kCB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163332, "uuid": "db74fa2b-8a75-41e4-b603-e88f40692a7f", "value": 27555280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163332, "uuid": "98cc2531-ab22-4131-b7eb-b12b98b1028c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163332, "uuid": "ac054b6f-e102-4bd7-b634-b8a506ddf67a", "value": "Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ae88d9-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776149661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149661, "uuid": "23b147ac-640e-4ece-a968-5ac06f557041", "comment": "Malware payload (ConnectWise)", "value": "1d464dcad7942233f44b79cf7048abb8", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149661, "uuid": "caf61a36-4ca7-4bd1-9fb3-fe447e7a7e33", "comment": "Malware payload (ConnectWise)", "value": "210d7ea746778038fd96b1019dae60d7535d62bb91e88f7f6bcfac4f21b4198c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149661, "uuid": "246a5110-3ee0-4527-ba84-32e0d8b8b9b4", "comment": "Malware payload (ConnectWise)", "value": "b9f40c4e63ab1ed52ebbdeced36cfef00336a16c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149661, "uuid": "0890d9ff-20d7-4ce7-bf68-f9d75518c859", "comment": "Malware payload (ConnectWise)", "value": "64f6810b1ac387f652f99b002a5bb6f73704cde9bec163aeaed95717f17466d60473e9816963195cfb5817e4d248a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149661, "uuid": "a41fde19-74a6-4986-9165-ab2260123291", "value": "T173D1979F7D43A3248871537BC819900FF5E80B3F8116185879CC49499F72B2DE7E2ADA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149661, "uuid": "1af20cd7-7f7a-47d0-b306-cb9aafb2b2b2", "value": "96:BTmhZD9Ec/apQNOwX0O8/X5DuS4UFAco6vWhGvq/4c/JiDuFXf:BTmh//LOwXX8/7bFAco6uhiq/4c/ISt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149661, "uuid": "a6245abe-3180-4228-bd75-4cfefacc7e48", "value": 6439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149661, "uuid": "a41ed40c-c44d-408d-8227-dcefb5179833", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149661, "uuid": "85a3a8b9-99f4-4492-8603-3e0edabc0de0", "value": "recording-120970381.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0cadb-3838-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776194991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194991, "uuid": "2652513f-53e2-4bd7-ae60-0381e3082d3e", "comment": "Malware payload (Mirai)", "value": "dbf99557a3f238225e5b04825a05b9e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194991, "uuid": "6582babb-2e43-460e-bd3e-81ae9e0c9ef3", "comment": "Malware payload (Mirai)", "value": "211a72c068eee915f42baf45152635677694fe09008d39d4276ed4914e9105fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194991, "uuid": "6730e0f0-252d-487b-964b-044dc0f7da4a", "comment": "Malware payload (Mirai)", "value": "a1dd6e46ff69e7ad2b51faf1c358e15d6c549271", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194991, "uuid": "eeded8d1-e511-4817-8012-03da849a74a0", "comment": "Malware payload (Mirai)", "value": "d72baa9bcaeb5f5399ace8233dd4179915d0db15c3d81e18d2d84f49a6b30ced87e29fb4d27753e969f22e302474d299", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194991, "uuid": "3bb972e7-cfbc-4e02-af81-843fc9efc7a4", "value": "T10B734A32BA320D2BC4D0657661F3473AF1F643E624BC861A3DB10D9DBF35A503257AA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194991, "uuid": "971cda1c-220c-4d89-bc97-007093b7f0bc", "value": "1536:Pg/W7ELMRomkzOkFHyTGtvf7Ym5rRAKIctqlBj:PdgGoFOtGBDYOdCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776194991, "uuid": "4f6eafdb-7d68-485c-8541-71db08562da7", "value": 75588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776194991, "uuid": "6ff5fd66-a792-4b9a-b21e-f3497134df30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194991, "uuid": "9ccfc04d-f25b-4960-940e-f08b3d328dc5", "value": "bin.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "051ec88b-3803-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776172104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172104, "uuid": "007d7fc8-882e-479e-b845-46a16981d6a0", "comment": "Malware payload (Mirai)", "value": "45f87edd9c050b198035ce9a2c379b21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172104, "uuid": "5511f8bf-78bb-4667-a406-54c97002db70", "comment": "Malware payload (Mirai)", "value": "244838e0a08dbc2ed1eeba16bdee72f906850e05b1255c40c754091f3e939abb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172104, "uuid": "091a317b-60d6-431b-9ffc-25e716f60d24", "comment": "Malware payload (Mirai)", "value": "c8d960d3464466714ec70278fb582e9fdbbea9fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172104, "uuid": "2b9e4b11-29ea-4252-8168-1c3065cc6da2", "comment": "Malware payload (Mirai)", "value": "90ac44b36493b0c7f4fcc5e4c6cf908292843d2bc2896a81e0dd07a7fb8f01be8bf43e48ad7a2c05d6e8322e28abe8e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172104, "uuid": "7414eb40-0576-4d09-a125-ea6aa928d4f9", "value": "T1DF233A49C703C1F0D8861570507BAB7AAE7AAC325570ED5BEB983A26BC32B11950B36D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172104, "uuid": "b97432d9-1f68-4231-bf6f-ee3f41dc4e0a", "value": "768:sXK15wniDa6PO5+m0h5phj+rJzm3W/NqNq1UJwlAscucuN7iKlkH1GsPK9K:sXK1KIfPk+m0r+om/P9cu5CGsiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172104, "uuid": "d0c7c238-2470-4e44-8d84-d21673cf3e15", "value": 45728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172104, "uuid": "e19dbbb1-27ba-4c9c-a94c-8f348e1f7ec2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172104, "uuid": "6311365f-f272-417c-96eb-203ca701ca44", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8847a072-37cd-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776149131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149131, "uuid": "e33027f7-9f45-4195-b5bd-729ce8add01a", "comment": "Malware payload (PhantomStealer)", "value": "db00747c2a365d5ae27079bb0e06404f", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149131, "uuid": "35f754bd-edb1-4b5f-98bb-301132e6bfb8", "comment": "Malware payload (PhantomStealer)", "value": "24f3e4903ee1885f6c51ca44146ecc279cd58b98bda41b875eb3a58fe773cfd7", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149131, "uuid": "0841225b-4421-4557-b2c4-84485cb5747a", "comment": "Malware payload (PhantomStealer)", "value": "a4985d339e55259f79efafc66db35e6fea5d6597", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149131, "uuid": "bd73b181-ca90-4320-ab0c-e0e9c1c0afa1", "comment": "Malware payload (PhantomStealer)", "value": "a477a7d2d7e819b105964d8fa660604b42ec225d5ddf94e951dfe777db3e402651ffdc5069272dac7020f3ad9e6c5f47", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149131, "uuid": "0151bbfd-cfc9-4912-b8fd-e1899a40b81d", "value": "T133E5D9E94D584EFC97B9FEB72C22CD0BCA9472A6C60F54C9936EA55883327C504C43E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149131, "uuid": "75348623-b62c-438b-b804-1aaed995e286", "value": "192:bBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBK:lcXZ/vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149131, "uuid": "e31219b7-b196-4085-b214-31f008b36762", "value": 3156671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149131, "uuid": "749eb01f-7ddb-4a93-b4df-efe06058d8e2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149131, "uuid": "1b7c23c8-0dd9-4609-bf8a-89e91f1316ef", "value": "kvptoJiKEZ.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d5e20a-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144567, "uuid": "0a24c874-1a18-45c3-99f7-9cf5a418fe5f", "comment": "Malware payload (Mirai)", "value": "d317afb642a05da6814f37c1b6cc0919", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144567, "uuid": "31ae69bc-05c3-4d4b-875a-4298dc59fe8d", "comment": "Malware payload (Mirai)", "value": "256fa4cb27d99e1eb0b979a4c64258014e3640157b563eabe3eb9ecd6970d5fb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144567, "uuid": "19856d43-8810-49c4-b5ad-19508c7e1118", "comment": "Malware payload (Mirai)", "value": "2b32b6865bea466ef909d51f21b389e6d18bfe9c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144567, "uuid": "52827d91-340d-48d0-b115-4895d9051bbd", "comment": "Malware payload (Mirai)", "value": "dab9a0bfee7e78cbafd82bc5b31f44ef7c4bbbdcbc1531543981d7a06db6dcc8f51896a4db641a3fe4d274f987607061", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144567, "uuid": "1c98dd04-6296-4bbe-a0a8-77789e8d5fed", "value": "T14DA3E90E2E619FACF769C23547B78F21A39837D627F1D681E29CD5005E6038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144567, "uuid": "da3328c1-2a13-45b9-adcd-c652bd3fe93b", "value": "1536:CaGzvw13umNzgo/homofiLdSbI+3+RpCnWZHoUHcZv5TeSVEpN/:0rw13umNMo/hGTMOWZHlOv5PYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144567, "uuid": "00298195-3a3d-41ba-8885-8291bb484b26", "value": 97808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144567, "uuid": "4d2b937d-adb2-4b15-92a5-14523166863c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144567, "uuid": "024010f6-6a88-400c-afcd-8151d0cd3775", "value": "dipsk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c844fa27-37df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776156970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156970, "uuid": "e2fae2c2-ab7a-40ad-99ff-9c791f6ae5f1", "comment": "Malware payload", "value": "e81be0494ee7013ae3db82da19cb2473", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156970, "uuid": "6b1fd286-629a-4a07-a970-5b40bdbc6720", "comment": "Malware payload", "value": "267df22197652534a9366e1516af6345ebd293be176b9230a28aab9c5e32c120", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156970, "uuid": "65413018-c9a5-464d-9843-d6a414043b77", "comment": "Malware payload", "value": "bee51deb62e95dbbe5574846fd5041ec6df59073", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156970, "uuid": "a86fe145-b6ac-4b60-a243-71362ac23340", "comment": "Malware payload", "value": "91811ce54413a80854d34b30f74532cb6d76ddaa9a9efb0868957c56e065ce05680ad524cc1595c096a7bbf2a3698565", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156970, "uuid": "90c6aa81-2b35-4197-a4b0-209a215c9d84", "value": "T12B112152370313BA8BB183310992A3CECB11606F216E14A0BAE891CA9FB1AD3425B60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156970, "uuid": "9f22212c-4a8d-4325-b5b3-f41925a0427e", "value": "24:gTl7IWJF9VBsRrIZ/6owBeUrTTcrH8WqOap1T/d9:gZ7LJ7VSG/6bLjWkp5/d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776156970, "uuid": "59be9a6c-ff7c-46ae-b04c-bcb856a5f366", "value": 969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776156970, "uuid": "be2b029a-2a5c-43fe-b423-3e8ab42bc3ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156970, "uuid": "8fd24f05-71c8-4e80-8597-1632d16e088f", "value": "PS1_HEADER_4P_Norman.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4374c3-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147900, "uuid": "0f6e3cb7-3a7b-43b8-9cd7-b60bf1055fe1", "comment": "Malware payload", "value": "11543ca306d6b42aad9414895fac13cd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147900, "uuid": "124cd709-002d-45db-a0e1-b155b62a8615", "comment": "Malware payload", "value": "28506512b8cae1bfd74c1125bf6df56ab533d80b60f0616edc33d744658aefb4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147900, "uuid": "cdbdecf2-95f3-4ccf-a26d-3f89e463f74b", "comment": "Malware payload", "value": "df9a3efe2cdabe8418c1eed28c80ee4d8005b156", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147900, "uuid": "29b66bc3-e11b-4b62-828f-521051ffd0aa", "comment": "Malware payload", "value": "d9c6f5ee0d6fcb61da1b4899dd18fa9011f4c27b397c4690e6c149384d186708df650ec983d6310a0f813e68a7233eef", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147900, "uuid": "57a796b8-aa01-4780-92fe-8da0346e377f", "value": "T135C16D0472FC1324E572DAB442308750CF77BA019DB292CC4232256C6C31FD49E23726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147900, "uuid": "9bbee9ae-e695-4fb2-b1a2-1209cc3ba3da", "value": "12:8d/8cr8ohPLrrVUhmJ3d4zGHyYgSUfO0luJFE3tz5U1GSEzwwuOvdSZ1SZa:8d/82rLRyYga0gJF25U1GRzwiSZ1SZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147900, "uuid": "7e579378-e251-461c-b694-cdb8741917b3", "value": 5942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147900, "uuid": "f311ba29-23a0-4098-827b-9919c5351eee", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147900, "uuid": "93ba9528-4444-46b1-84e8-18c846d5dd16", "value": "Dodatok.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a9f9bb-3843-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1776199783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199783, "uuid": "c4ef8efe-ccd9-4c28-b62e-546298cfaa86", "comment": "Malware payload (Gh0stRAT)", "value": "266427f7f96cc8bdf48dda926ec212fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199783, "uuid": "1a68ccca-14a9-42ec-8a1c-e3a29367602e", "comment": "Malware payload (Gh0stRAT)", "value": "2ab48cf9bb3227de8475e8e120b30e91789df69d9c66883e947375593920983d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199783, "uuid": "1c06043d-a62c-454b-808d-36506a840fb1", "comment": "Malware payload (Gh0stRAT)", "value": "46d84c9c17a77aa634cf79fe18b08d51e4961b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199783, "uuid": "1cfcfbdd-8af9-41ec-9468-f35e5c7a7590", "comment": "Malware payload (Gh0stRAT)", "value": "b1abfc728c1848bd6a3d00df93949923e6f1272287ba7ae65c58cffecf0dde0a24f0f16a57cb8e94c40d726ffabcec87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199783, "uuid": "f66586e8-04b6-43c5-b3e0-a317e8d6f69e", "value": "T187173313F1CE673EF87B56351D72AA10053FBA11662A8CA386E44D9CDE2D4A41D3EF06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199783, "uuid": "6d2986ba-a929-4297-a32d-e85a0e6b7bc4", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199783, "uuid": "365a2992-d78e-435c-bab9-a744487dbc02", "value": "393216:WDAi1Ne5STq47J+K/WyjZdxIeO4rm1ZrLxCl4n8+SF1Hb:five8TqU+QxjZdeZrYl4n8BF1Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776199783, "uuid": "f35e29bf-1530-4f96-b0e8-1ba4883a591d", "value": 19852224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776199783, "uuid": "1ecbc6c1-0c7d-4715-97ed-c729bf8c07b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199783, "uuid": "373ed739-b02b-4ed1-b04e-241a9a3273de", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35a75c7-3849-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776202461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202461, "uuid": "3eb0160b-89a6-41d2-b58e-92c0588f9341", "comment": "Malware payload (RemcosRAT)", "value": "c910db30d931e4462d989026fe574155", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202461, "uuid": "51edab3c-e0fc-4fd6-b723-f5f848677eff", "comment": "Malware payload (RemcosRAT)", "value": "2af86dcc149f8d47bd2873c929d6b9cf03af542e03b4d14e1043fe9bac91e073", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202461, "uuid": "0f82f688-4edf-426e-a1bf-be71b681219d", "comment": "Malware payload (RemcosRAT)", "value": "2ac4e7f7f9600c84024333efb930095fa178996f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202461, "uuid": "155156c4-6cff-469a-bb4c-a478cd9a61c3", "comment": "Malware payload (RemcosRAT)", "value": "a6d788bfcd5b786f0704ee3711a395335599c54101dd04508e24dbcd6473f653fd638f4f59895ba90061d3a01047c474", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202461, "uuid": "22d55926-835c-48c5-b45d-e0f9762766a4", "value": "T178B4BF01B6E2C172D57660300836E735DEBDBD2018369D7BA3DA1D57FE30290A739AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202461, "uuid": "cbd3be46-1f77-45ea-aeb1-a6f7e608e8a7", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202461, "uuid": "1cae95b1-aa7d-4baa-90f2-201d50c7e43e", "value": "12288:Ng2cpfSUy6oFGNfZvCcXmw0z38qsPZ0Wx+:Ngdfty6oFQfNwz38JZtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776202461, "uuid": "182a4ba0-c07f-4b21-baae-1cab4d37e4cb", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776202461, "uuid": "8aeaaee4-a09c-40fd-9df4-c0feec8b52ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202461, "uuid": "c9ab1cb2-6f03-4fc7-b6f3-cb30b1d87c66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad57c61e-37c9-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776147476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147476, "uuid": "d566a92e-004a-40e9-9c16-fb51c2f636a9", "comment": "Malware payload (RemcosRAT)", "value": "f24c172e17d3f3c06013410b4f31114f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147476, "uuid": "b80a8b7c-cbcc-4682-915d-47d280b8aab9", "comment": "Malware payload (RemcosRAT)", "value": "2b0f5546b026f1b961571048572b0b9ec5adb52442746c96e9bf787a2bb7ec5d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147476, "uuid": "f08a601f-8566-40a9-8ea9-8213a992db84", "comment": "Malware payload (RemcosRAT)", "value": "85dccdbcc7f503aa6bdc5564e526587664471108", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147476, "uuid": "d107485a-93db-47a4-ba4c-2dd366ff9ae6", "comment": "Malware payload (RemcosRAT)", "value": "ee8f696c39fc38bfbe1572c91f2882dc6dd6a93efc82c88307c01d7213f69e12c1a03d0b2f8b4eb615d12d02f63a7367", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147476, "uuid": "d7ceb4fe-69e6-41d3-9b19-3c542ab5e90b", "value": "T1AA2412ABC48BC9A7CC3DE13E63348DE9B215750BF21678392829206D35157DB315CE27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147476, "uuid": "1d5fd502-367b-4a52-b3e1-09d7b1dbf529", "value": "6144:Vsk725geUsZIUbbuzuQjzbU23umBhqkW4A9TKlf6WWLPd:pMGaXCCe0ou2aQizd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147476, "uuid": "66a9451b-c94d-4fdc-83a1-1cf75acca19e", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147476, "uuid": "55147eb9-c286-4683-a88b-205bf7b47886", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147476, "uuid": "5198f516-5442-44fa-9766-a6648b52cad2", "value": "CHE265028A.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff6e07c-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776152607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152607, "uuid": "0c637064-7a39-4a60-a0c6-d6507c5f6adb", "comment": "Malware payload", "value": "d08ec44255ea82b0f422fd71e4a58b02", "object_relation": "md5", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152607, "uuid": "30debff5-c72f-44f9-acf3-b49446a01823", "comment": "Malware payload", "value": "2b95f206c9f6d7bda076bd500a8f67d9bf245356aa9c47c47543615205f02693", "object_relation": "sha256", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152607, "uuid": "789d373f-397c-4611-9618-f44db0e21667", "comment": "Malware payload", "value": "8cba9924f3129ee9387324a80631a48443c10914", "object_relation": "sha1", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152607, "uuid": "74236f7c-4221-4bfb-a63b-c113e1349ed4", "comment": "Malware payload", "value": "de62002104ec7179371183f508ec43041aeb288e2da6dd2baf481c0589679604c8251377fdbc3b8b4ab00e372c6ef588", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152607, "uuid": "996dec1c-7947-450a-900d-e8002797a2df", "value": "T1A552886C09BDFA5993D9E207E699F3276D465CAFC2B875132AF38C6C90025C085EB4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152607, "uuid": "c6ec2939-86fa-45a6-87b0-6e320f6373ca", "value": "384:I2nY/muY9GFkSHAqqB6XmdEvBUsW2MrDLMdfYaVVvbRG0nlAdmL/pBKoRe5HOFSb:I6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152607, "uuid": "09cef355-4ba6-4703-b5e0-1564ade73238", "value": 13830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152607, "uuid": "a50b2be7-5426-4ef1-8f5d-f42758b48c7d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152607, "uuid": "82c425be-4f60-409d-b56e-3bdf3aee6abc", "value": "test1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9975e174-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130692, "uuid": "cf3759a2-6c68-4987-9736-c446c72c599c", "comment": "Malware payload (Mirai)", "value": "393ce984aa764d0ca3e4c7663aca0884", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130692, "uuid": "c068136c-e522-4213-94a2-951b7e435eb7", "comment": "Malware payload (Mirai)", "value": "2c25d0736813e54e7030d6b524e532f73c36c9b5f07d38734dce2ec3e6edce5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130692, "uuid": "6d9d41db-a40d-471b-b868-fda96013458c", "comment": "Malware payload (Mirai)", "value": "76ac3ad9516207a4516a3bbbd94513cc8be4a22d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130692, "uuid": "c0d677aa-0ef0-4e75-a282-bedf703476de", "comment": "Malware payload (Mirai)", "value": "a63f8951bfbab297f8a7e0db1de3094bc3a807abc925930fb49c896a9c5f1b17ba1ceea69744e38d60e5bc857cfa86ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130692, "uuid": "aac93444-d77d-4f7a-9cd6-375dda464750", "value": "T138314F8673B16C068DA48C09EA41C0DC0116F66F0B1FF3BEDDC919A9E0F974AB218F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130692, "uuid": "cfd1bc76-ff85-4098-b982-284113940c73", "value": "24:HWEWwWFiWFNIrWfWgWtWiKSWGWYJWPlWPu5WziWz4Wt3Wt0xfFAuWDxWAgM7WZ4u:HtNvFARKJbJpqlqu5aia40LXY3gM7Y4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130692, "uuid": "9a1bd04d-a9ab-4aa9-8db8-621691458ca6", "value": 1494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130692, "uuid": "e0cacd53-417f-453d-a564-a9bff26dce72", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130692, "uuid": "0daa81d0-aa6e-405b-999d-18d69424a83d", "value": "move", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f910e46-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776165008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165008, "uuid": "d1d00336-d606-4165-b99d-b02c85881a47", "comment": "Malware payload (AgentTesla)", "value": "faf5de563c21a1e5275b882e04303726", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165008, "uuid": "5e2f148b-a344-4bcc-9e6f-27b79fb5c3dc", "comment": "Malware payload (AgentTesla)", "value": "2c8bdb1697334d41f75d1b26cd8226848432eb93b7bf26b950964084b9292ecc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165008, "uuid": "4e46fea7-52a2-4004-bdf5-8708821de64e", "comment": "Malware payload (AgentTesla)", "value": "ff8feca627b42a155812eed3e18a4b18c1460288", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165008, "uuid": "06fe085e-c92e-4279-8f16-ab7114bbedbb", "comment": "Malware payload (AgentTesla)", "value": "d264cdb6a8f5e337bc9546789800a7eab1a06a20e25ccef2aa6cc363b1228fa858092e258df8de5a1b4fe7ca9c1880b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165008, "uuid": "f019aa16-1171-4f8b-bfcf-26e99b1fb82b", "value": "T17665025049C82FF8CF5C661990FE160EA3F04D8A951A794AEB73BD4BEFFBA005117099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165008, "uuid": "df957cb5-87e9-4c86-9f87-b7a1df58f119", "value": "24576:dWOUZwPn397SjGa/qfaTRcjJVKfQ/j1Tg163IjC2ACfb+Mjt:vtWCLJVn7UjBs8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165008, "uuid": "2676f05c-36df-4972-89fc-b56d5bffb92e", "value": 1432603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165008, "uuid": "a58f7634-472a-4117-9db7-cd10f23a754a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165008, "uuid": "00c67450-0b8b-473a-a868-daa874074bc6", "value": "Purchase Order 2684.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5337ba6-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149744, "uuid": "8bbeb1cd-1f01-4785-88d0-1eb18ef2d182", "comment": "Malware payload", "value": "2017dc99152207aada31ee0c4ed6a8f9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149744, "uuid": "da4d9e59-4914-4311-8ccb-b147e661b177", "comment": "Malware payload", "value": "2c9b07f40d33b84fff22b33d4d1554f166084eeda11637c5841c616d864a6dc8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149744, "uuid": "2a2a706b-084a-44f7-85f9-86a1f1690d98", "comment": "Malware payload", "value": "51f0ece0449b3704004d7acaf409baf3fa2648cf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149744, "uuid": "eb45bcdf-3f32-45ef-a13d-eda0f20f1994", "comment": "Malware payload", "value": "3087ed20989f80b9560863f73366eafdc428f782378c4bf7e152686fc6d7a0898acc1deee6cdee8b5af20c69ecc032b7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149744, "uuid": "e1b17d31-c089-4b5d-835f-0b5df7aeb98f", "value": "T1E151A683F11F55B497AA9361C94271ADD31B53410A4B37003DFE800AFF21F58C3AA349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149744, "uuid": "e61cf541-5f4e-4bef-82fe-4af3c06796f0", "value": "48:ooSLFnIhyN2mwPdRs4AF94f89Z84hOw20AEsVb4krMN2PtaMPnr69bWE+EZpxjVG:XSp8yq8d/oG8HBrFbnr69bWE+E3xjVeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149744, "uuid": "d5f31c0f-db67-4608-a1c5-e76d665e7d39", "value": 2628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149744, "uuid": "03d3d626-968c-4fb8-acfa-f963de7f2f33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149744, "uuid": "f35d7009-8748-4813-9ec4-ad13438973c4", "value": "code.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cd3b5d-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776149751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149751, "uuid": "3d6ab578-04ab-4f4f-9da3-d811c12ab92a", "comment": "Malware payload (PureHVNC)", "value": "9a4c61f9b2d290bc8e0939591f8e7a42", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149751, "uuid": "f87af3d7-dc9c-4a24-bb19-8a477f1790bd", "comment": "Malware payload (PureHVNC)", "value": "2d9d3c0cfdca2e96c13788f38464066ace526326cb887a0f7dc50f9e5be17aad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149751, "uuid": "25598088-95cb-4d9e-afd8-5a115533c5de", "comment": "Malware payload (PureHVNC)", "value": "c822bffb53ac66f93ebe73384f54e84d3dc7f645", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149751, "uuid": "f6ed556c-6249-48ad-a853-ce9e8df65b65", "comment": "Malware payload (PureHVNC)", "value": "0a0343e12c3a9b3c352d89a74b3288722255219696c9c175387d9aee5636336abbda5677b727f6b01c13f7ecb41087c5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149751, "uuid": "bdde14ec-0494-4429-a4f4-64c73c00faba", "value": "T193844B3DCAA5001AA1B6DA14BEA60423F5777B132B3D9C4812C9128D47F390DB5BE79F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149751, "uuid": "4990d3d9-15f3-4e1e-9951-1a33d1c28d05", "value": "6144:50nj7qHSrtO/9FHt+dMqrJxaUvZ5f6Y6/r1JAXTGreHfgK7FHVoWtz6aZ/1HaPDl:5DHn/9VgdMqrDa+ZcY+JOXS6Ho0F+IRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149751, "uuid": "3caec45c-10db-4469-be69-c840d0a753ba", "value": 380982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149751, "uuid": "1540f680-a2fd-4bad-afb9-6037b20638b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149751, "uuid": "850fb7b3-2de1-4fb0-b9ad-5e9c8b50b0db", "value": "SCANDOC413.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dddfa28-3828-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776188198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188198, "uuid": "5ac05b2c-eb38-4958-9a90-5ae89435363b", "comment": "Malware payload (Mirai)", "value": "f5687ae03de7bf07eaee91c0c6be122c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188198, "uuid": "a66372b6-ef95-4608-9503-1207feac6e20", "comment": "Malware payload (Mirai)", "value": "2e4b12f88e44bb7db852b8f3f2c61c75085469090badccd154e67ceb885ee6bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188198, "uuid": "38fd0a8b-2c35-45f6-a04f-58d5cb3fb2dd", "comment": "Malware payload (Mirai)", "value": "f4884ce442d6190f0a9192eb5446e600fda4135c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188198, "uuid": "36d13525-ebca-4d1f-aeae-80c37d38ca04", "comment": "Malware payload (Mirai)", "value": "858b371a821154803c0c82b94a7e0342c6b615499a83181dcc659872988e97e97527a83168fcb1c756b03eede1376177", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188198, "uuid": "dc4a268e-d429-4290-b321-e1f1c9600d32", "value": "T186E35DC0A243E4F9E95A41746137F73A5B32F03A512ED983C7B5EE33AC62951C51A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188198, "uuid": "107e2991-0b17-44a9-a608-cf42766d45f6", "value": "3072:Db2vXLDJxmZal5jTB/ukA0Hl62FCyRaAa6lmGPLz4NLjYT7:D6v7DyZalpV/ukA0Hl62FCyR54UH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776188198, "uuid": "59ed2662-f5d6-4993-8a68-6e936dd9d6cc", "value": 143816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776188198, "uuid": "7c8e4a65-ab3c-4b22-9ba4-b1a2906ccf02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188198, "uuid": "1e8cef30-736f-426b-aba1-28aa8bca94fd", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810373ea-3795-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776125067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776125067, "uuid": "c0e7926d-60c3-4091-99e0-3b0c00ae3237", "comment": "Malware payload (GuLoader)", "value": "4edf25ef10c53fac1806d689c42afc4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776125067, "uuid": "313e2c9b-b631-47cb-84be-9d49438ae00f", "comment": "Malware payload (GuLoader)", "value": "2ecc436c6d8c643320713e3faadb88c2575ce31893b14590474253c738d933d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776125067, "uuid": "71490c3b-9e3b-4db4-8028-909b962dfb8a", "comment": "Malware payload (GuLoader)", "value": "1c218a27bcddc3015826204f88c6c6bd05824ef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776125067, "uuid": "28a3b5a9-4fb5-4275-ada6-4a1589a63ec6", "comment": "Malware payload (GuLoader)", "value": "90001f99fa36324a248b17d2a2fe19388ab4abfe5dfd8570ccc62794075b0a62726ee8472f2bd743298d7365d923f585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776125067, "uuid": "8ffaa451-4b82-4c29-8512-de6ba0112270", "value": "T1DF569E17FDB808A9C486637A883362437E38B440472123D76AD9636C1F677F4D67AF29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776125067, "uuid": "04d29f8d-3aee-42cb-9b47-83bcd918e9df", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776125067, "uuid": "2d2ba430-4b35-44bf-9ba7-645fb5a08865", "value": "49152:F0EDbzvawfLlW5YLIJbReAxIsPMTjzcQcqzN25coLOwng+luObcq6Cyladlcb4un:F5f4YCxIDt19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776125067, "uuid": "bdd2dd52-8310-4666-a5d9-c325017c698d", "value": 6293531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776125067, "uuid": "16770455-6a21-423d-8e8d-71b2a1781503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776125067, "uuid": "f320cf2e-b6b8-44e8-9966-ffe620396588", "value": "SecuriteInfo.com.W64.Agent.ACA.tr.9707.23505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a7440d-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776165022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165022, "uuid": "3d44c7df-0fa8-4bc0-8323-46b78f9574cd", "comment": "Malware payload (Formbook)", "value": "023a1c38e273e23db3fe20ea53fa5cf7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165022, "uuid": "cdb09728-5529-4f36-af34-d00e51c8b9d9", "comment": "Malware payload (Formbook)", "value": "2ecf3e0440ae34436226bd186b9908a9a4802c45fe4fd69c63a628e9ad856a1e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165022, "uuid": "ca135631-ba9a-4c03-8f8b-71a794d7f86d", "comment": "Malware payload (Formbook)", "value": "5b27485244b0a1a85f9680fcf12d2a700129576a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165022, "uuid": "00a0a5f3-aaf3-491d-b3d4-79240341014a", "comment": "Malware payload (Formbook)", "value": "c3b32026bcaa9c19e57e75ed758acd23b6d92e6c36a64bd7e6b4fa537e826c273e0083e48513ebe8559c3d04be8af62f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165022, "uuid": "3b0ee383-8818-4d70-9962-fdc19a10473c", "value": "T16A9502158AC43FA8CFAC561D80FE150EA3F04D8A5419798AFB33FD5AEFB7A045217198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165022, "uuid": "9381ef30-2fa6-48fc-ae3d-ead0a921766b", "value": "24576:v7nCcxLKF+V2/fK8RR/Ne09DadBI1Hl24kkQDXAH13v1YZ2MfBQrAeAqXOIxo:DPxLGXNbmEr+K3mAUeNex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165022, "uuid": "be77a8a6-4aa7-45dc-bc5c-f56b391ff6b9", "value": 2055638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165022, "uuid": "ecc3931d-8a90-41a4-861c-75ce5b7ac7c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165022, "uuid": "2cfaaf72-f75b-46a6-b88b-8af6b9fffb13", "value": "PO 4501058566.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00c5876-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147910, "uuid": "0c17a53f-38b6-4775-b55f-a9f79a0057b6", "comment": "Malware payload", "value": "82cbe82551e795572874799a48c4b78d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147910, "uuid": "e7819e27-3903-449c-8f52-b1132ccbf77d", "comment": "Malware payload", "value": "2fbf4f0a085963a377b21496dbd90cf98aaa0c5460f7059d3205bfe27d206291", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147910, "uuid": "d96703fd-9171-4139-b4dd-b5728c183ab7", "comment": "Malware payload", "value": "120cc1e0e6d0698e7dd4719bfac489b239ec2a0c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147910, "uuid": "a2069983-1305-4735-97c6-85a4c9686556", "comment": "Malware payload", "value": "c9854b9d5c25505e8b80e3166a5725d53631e868ceaf38e881bfa7eba319f01262fe4080f444ee2116d206e11f854c26", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147910, "uuid": "e5e602b7-1152-4974-8830-a40be62f33b0", "value": "T145C1901476EC0711E1F38F79DA305344DBBA7942D971A2CC155262BC2C61BA49D12B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147910, "uuid": "4ee6b83f-6711-48ff-bdde-488c6ef39a6b", "value": "24:8d/ODlLd9EbWyYgSk0gJF+1GRzwIDLHmH:8lODlJ9yXSkHF+1SDLHmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147910, "uuid": "5404d349-918a-4c2d-af12-4d954075429f", "value": 5968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147910, "uuid": "2bdd386c-390d-4b7a-b3d1-72973354def6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147910, "uuid": "35d1b27b-0936-4be0-aaf4-d78ce5bdfe08", "value": "Onovlenyi_dokument.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6aa63b-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149596, "uuid": "7902ea6b-dc11-4a26-8d48-6e4d4dffe621", "comment": "Malware payload", "value": "3cdff9689027a7483151b8f4994be55b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149596, "uuid": "ad021478-ec26-4e5c-935b-463730384653", "comment": "Malware payload", "value": "30e8be76f9f1157be07ddc4c188fa4dfaddbafd9f2e01fba9d9bbeeb92c13fb5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149596, "uuid": "06d9fc01-d18f-4daf-9664-0c2fe31513cc", "comment": "Malware payload", "value": "3f5a9ca08c00144b77799d21b53b01c9a6b26df8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149596, "uuid": "85d8bae5-3229-4eef-8d1f-f52f59ad27f2", "comment": "Malware payload", "value": "64178dc7a21477f10387625c033fa251c8492edf0e956514bdc22f9bb6f89dbcdfdcfafd92273493126400bf1b49042d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149596, "uuid": "e9369a53-4a0f-4a6b-abf0-a14a95ad47a1", "value": "T11CD51277D53DF119D2598A0564CF8CE8AB9909EC606818AFF086C3317EB46B986CF07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149596, "uuid": "23575ec8-2b50-4fa0-bfb4-158ae83ea6d3", "value": "96:RAr4cjkeSGue/3VU8ph6/6U4bYLlLs7bjo4MjidooYRGHgykHV1LxiByt6eXt39U:nSrKRXWilvZXRGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149596, "uuid": "1d3ac572-27c5-4f3c-9164-73ce931c45a5", "value": 2893021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149596, "uuid": "f0eec0da-5447-4bd4-afd6-72dd08dc31d1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149596, "uuid": "a5adfe32-f116-47ae-b96e-382895c6486b", "value": "ORDEN 60 RFQ 260303 02 ARCOSA_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c82db8-382e-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776190929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190929, "uuid": "176b1cc4-ac53-4fa2-96f0-6f00f33373b2", "comment": "Malware payload (SnappyClient)", "value": "402b6333d6725eaeb66bb61add432909", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190929, "uuid": "84a02122-1c36-4f2a-9262-f62d10be7725", "comment": "Malware payload (SnappyClient)", "value": "3117ee3f64f78f3ca8de5d5299947ca34e2f2fb8302627b1dc8f7ac23b046fc1", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190929, "uuid": "116f8bdf-abfb-447f-8cbd-f25b42e760e3", "comment": "Malware payload (SnappyClient)", "value": "d48ef109b10097c2fe584c143915d618e4999f67", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190929, "uuid": "d93bb7a9-34f9-468d-ae23-307e45dcb8bd", "comment": "Malware payload (SnappyClient)", "value": "b0072890dce98bea51682b9714dc524dae202387d138c63fedeca2671e8984000d976ac655d91b11bb55c049550dd9b6", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190929, "uuid": "13825d52-0190-4051-a80c-3c982a76a9f1", "value": "T140662332E5910022E2F2067BBD28A5303D6CF338176589B9D3D5E94D3AB84D66BF3257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190929, "uuid": "5d01aeac-9489-4842-8e10-5b13c5db7ec5", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190929, "uuid": "df4c86d9-5751-4d57-9ba4-93c7fcae2dbc", "value": "196608:sfUE9PzeYV5Qzi+3QEztXe4WddsDodfkcUSng3HM4:8XR7QzL3QMuZ84fkYng3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190929, "uuid": "99fe7675-5eaf-4d54-82d9-537e4307f258", "value": 6746426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190929, "uuid": "3c725ec4-3f94-4204-b310-23209af17aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190929, "uuid": "a46daa58-ec8f-4503-92d9-dfaceb446908", "value": "3117ee3f64f78f3ca8de5d5299947ca34e2f2fb8302627b1dc8f7ac23b046fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc39715-37d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776153275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153275, "uuid": "0b95f53e-8610-40c8-9d9a-dd2d00cf9c5c", "comment": "Malware payload", "value": "16b9546956442f2694f98039c932060e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153275, "uuid": "6ee48e37-92c0-430c-873b-138f790c7b8e", "comment": "Malware payload", "value": "31abeb72e1344d506c96df6802126f48e4e2e0f95056c6c51929e38a7d73eca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153275, "uuid": "0d485651-5d66-407b-a13e-091a0072fd91", "comment": "Malware payload", "value": "701b7ffbb8099f44abfa4649d5e2a7b2742ec8bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153275, "uuid": "ff680326-9e42-4f70-82a7-478de283dffa", "comment": "Malware payload", "value": "bff95e169b74a46768176118e39677d9f7b7ef99c83e6cf63fe79273d0eecf39039580d3e3507edadb8ae140b6b41bd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153275, "uuid": "96eb94cf-6b92-4727-b348-1e8a8c329d98", "value": "T19B95DFEFBB6075D0D9256EFC94C56E0187B4BDE4BAC0419B2286FB2BCC78A438F18554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153275, "uuid": "93d96d0d-7a2f-4057-9845-4964bba53ea3", "value": "49152:YeaQpkRBd1c1rBcKmNUNTIpJws3fUEUXIrZlO:YrXu1OKmNUNMJwsUKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776153275, "uuid": "08e9449c-c8ca-440d-8f02-4bfd9268afe7", "value": 1927176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776153275, "uuid": "3d7df342-b1a2-428d-bb77-b4da7eb03653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153275, "uuid": "25f665fa-2139-41e5-a550-1a4b8f7a3dd1", "value": "16b9546956442f2694f98039c932060e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ade6c2-37c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147521, "uuid": "10544ed6-d887-418c-b777-7eb990ac9809", "comment": "Malware payload", "value": "fbc89cc22a96391c3c9580f3f8c5f107", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147521, "uuid": "e5a2e2e0-98a5-4ebe-a8b6-7f5bb471d917", "comment": "Malware payload", "value": "321285609bb7c0d63999a6d3a93cc5fdc737d0397642a9e57486019ae169a520", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147521, "uuid": "b7bbb5ab-70f0-47fd-8135-9808347cd202", "comment": "Malware payload", "value": "1cd16c95f00627821fe39657e6bb34e313e1e52b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147521, "uuid": "4ce32bc5-7b60-49c3-aa67-d85335e61467", "comment": "Malware payload", "value": "fc448733b69e415a4b0c623e0304ac3d3c313fca9d626c301f2e33646f4adaf066c4e1d5007b5221d5b89e2e6ab3dd1f", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147521, "uuid": "a17eea7b-90cd-477b-bd0e-b9b7240ac4b5", "value": "T11CC27B61BE58B0B85ACF371777F4F89254387BB1A08A690CA4EE54C117D8FE0B63C1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147521, "uuid": "03159656-0845-4f16-b68a-d4ea20fef568", "value": "384:A3CsgVjzcH+H9Tbv68xseCxhoFpKHCza5k2yFHJhdEKa:Pdlzyg568xcxhoFpMH5kXFHJhdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147521, "uuid": "0fcefb01-23ca-4d58-8218-ba77a9596c4c", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147521, "uuid": "14512ef7-9e1f-435b-9093-787274a5661f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147521, "uuid": "2a569536-46ca-4330-88a2-80b148920d2d", "value": "form_45429.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb99e92c-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1776149647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149647, "uuid": "fd9e6d8c-ae26-425d-bf2a-8734c1ea84f8", "comment": "Malware payload (XWorm)", "value": "f6e21ea9458403db23d8915daee1b6cd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149647, "uuid": "3841ef9c-95fc-45ef-bbf9-904bbb619cfa", "comment": "Malware payload (XWorm)", "value": "321fe61bee4099071c2a6dcb369d267c0a17fa906c773b563dd0cef5f3ae0b9e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149647, "uuid": "14b4390a-e21a-4869-b7e5-6a4846310cd9", "comment": "Malware payload (XWorm)", "value": "bec9d76628978f1d6ca1766a4784624ddf291cbf", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149647, "uuid": "23c34d09-7e5e-4575-ab98-2f3604240db8", "comment": "Malware payload (XWorm)", "value": "e3a9594c7fc72fc7b8992b7743baca544579f7213750946d74a46dc18fa6501a555077a50aaa22d32363eaaf8bed5933", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149647, "uuid": "c0a2326a-87ec-4f89-a2a0-5c9d9fb615a4", "value": "T14AD51DB083ED359665CCCC0398B43EA01607A697861E714B5A64FE63FA316D316EF1CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149647, "uuid": "a7566447-d925-47d1-a5cb-3d2dffbfd790", "value": "1536:2+w9NfmnUetmqzyZAxGo+fCN+xRhT+vrHLKBcBGPZTEm5rjRcjYqewYShSS9MlZm:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149647, "uuid": "1167d9ca-6021-4150-a000-6956fddfc27c", "value": 2955362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149647, "uuid": "d17f47ff-0e8a-483f-a9fb-6f48b496f574", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149647, "uuid": "3c95bec1-fa98-435e-8ffe-3d52d076e61f", "value": "ORDEN DE COMPRA_Xls.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4177a85-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144561, "uuid": "f7735933-a02b-4084-acaf-aabec53fe80f", "comment": "Malware payload (Mirai)", "value": "21efa4621784467039752c6e78d36c80", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144561, "uuid": "e376dfb5-ba59-45f8-a8cc-2a00a52e3a08", "comment": "Malware payload (Mirai)", "value": "3287b04f6216add12ae874cf7e1ef060b604649395dff8fa8ed246016739fdb0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144561, "uuid": "00605d25-b6d8-4885-994e-0eb875b02f3d", "comment": "Malware payload (Mirai)", "value": "0773bd99270d928d66f0d5a46e7c9273060636b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144561, "uuid": "759f0e7f-ba22-4585-8678-a1eb769bc364", "comment": "Malware payload (Mirai)", "value": "2424984338a7c930cb979e0c156ef8af4d3096771bd40f33e4fdac2336c0968ec2c3cd377bd52b663d82fa8893b1661e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144561, "uuid": "98c54055-8667-4f85-b423-42a1f9f5de0c", "value": "T19D635B13788190FDC49AC17807BBB53AD933B47F1239B26A27C8FF262D89E606E5C545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144561, "uuid": "7480555b-57c7-4279-88d6-0217ff27dbdf", "value": "1536:CqNledrrTDL9EdJcCe4aMg3nWDzkua1GNwQIHK/4BUvZqm+T1i:DTwrr/LQh8Mg3WD5a1GNwdK/4BU7+T1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144561, "uuid": "a94652d5-f4e9-4786-ad61-51053f2e4164", "value": 72960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144561, "uuid": "a71dac96-6298-46ce-a4f2-d5b5842c88c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144561, "uuid": "cadcd57f-68d3-460f-adac-88832ef52846", "value": "chromek", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4abf11-379b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776127747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127747, "uuid": "9aa486d8-2ac6-40af-8af6-39d1b090a64e", "comment": "Malware payload", "value": "f6a6a99d9c0c92cbf92a54dff5ec062e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127747, "uuid": "ab7e0925-3970-45fd-babf-f1f2cfe4805c", "comment": "Malware payload", "value": "32a80c3a08b100db9c811321fe445c9c545fc9cd8b93f66e6d433f4578011882", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127747, "uuid": "8a164331-d47b-4622-b055-0bc1529a9a3d", "comment": "Malware payload", "value": "10d274f354bb871df794881f810c91e69dc3cee7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127747, "uuid": "3771dd3c-a0d4-4665-bc4d-721014ebc593", "comment": "Malware payload", "value": "775fa9a94b77439320c935b201c91105623db3db83614e8eb117c54a8acdca616b44a76120c1a529b210b3dfb36b8b6f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127747, "uuid": "7bff635e-2391-4f4f-96ec-159a164c61c2", "value": "T1D2136C6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127747, "uuid": "824c70cf-2b4d-427a-8054-2a74d8449b79", "value": "768:bEXRWNGxVQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b4lxbcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127747, "uuid": "59354b56-aa0d-44c5-922e-3304da504850", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127747, "uuid": "9402afc7-3923-4f36-86f1-7780d9b51b6b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127747, "uuid": "2df736e4-81aa-435e-ab12-79d5986b3ab8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786dbe88-37cd-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776149105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149105, "uuid": "e2fa7185-9846-41d7-ac0c-ee02b1e88b0a", "comment": "Malware payload (PhantomStealer)", "value": "d5e2932a0a4cc5b74521a684d00be40d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149105, "uuid": "37872af4-3dc4-4810-9e1a-49f326d524a1", "comment": "Malware payload (PhantomStealer)", "value": "337e81bd4da7fa032644a5cd57ee10144b45cc4a08e92a62517c5ee507d31d91", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149105, "uuid": "d707cdb5-7efa-4844-a48f-75a0421754b1", "comment": "Malware payload (PhantomStealer)", "value": "c57213767acf822b3a8d240d83aa04e739499a29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149105, "uuid": "58083d49-77ef-490f-af45-fe4e70c07035", "comment": "Malware payload (PhantomStealer)", "value": "5a63f8eb856afb5f87bb9cfee7649739d786d2bd258227c60b7b72722abc0a9c0435ea1bf75865d6d13f2d4e104de6af", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149105, "uuid": "4e447d25-ddd5-4298-ab99-0f0204e5aaac", "value": "T1E5667140E79DD772F3A5BB9D453AFD30A9095A1314C4DF1230ACE20C379892757ACAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149105, "uuid": "dc536d2a-c18a-473c-975c-a58202065f74", "value": "196608:ehMlsMokvEsYAlqMBnGtwxUCXJLStMz/1XRdGwbfSNus:ECXDvEsHldBnGtOU0OGxhowzMus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149105, "uuid": "6178be62-929a-42fe-bda7-1502c78ca561", "value": 6994190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149105, "uuid": "ae873fda-77e7-4a9e-be6e-3617b3d4b2f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149105, "uuid": "9c996f0c-89af-4247-9f9f-816ea0760761", "value": "order pdf 660196118.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5288b4-37ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776170558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170558, "uuid": "a9708b87-7fa1-475d-a2fe-8c7f6758eea3", "comment": "Malware payload", "value": "40f2583ad87d08fe49d08e32d1bebe3f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170558, "uuid": "26d8082f-b417-4b31-ba78-783afdd15ac5", "comment": "Malware payload", "value": "33ba50dafa6a35c727b9a980b0d4c8809d061ae434ec072cee0d5de022e1d6d7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170558, "uuid": "cb35901a-ee89-4ce9-a3dd-b2264b32dca9", "comment": "Malware payload", "value": "ff74b150bd04ee04166503da7c617b932877dc3c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170558, "uuid": "969c9a2f-301a-4ec7-90c8-cc3b88c8ed7b", "comment": "Malware payload", "value": "cab225c5a77b22314873e2f035c1f6a08215527541d3af1e79f8f18855621c0da9be3c9e70cff03c48593984f66d4146", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170558, "uuid": "03c48c08-5000-4ef6-9db3-04d17b8ee51b", "value": "T1F1B5118E41F8E846E90B7449A0C959C2E1BE3B7DDFF41CACE95BB5CA0E0590D06C6CB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170558, "uuid": "3165e8c4-ab0b-459b-8280-c987b8dee623", "value": "768:pvWGjj41v5G2GE55Go5t5F5E44GfvGvFjG5GG6Gv5vGvGv5F55G0j6415tv5G2G+:pvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170558, "uuid": "01d76dc6-cc7b-421a-8ce8-48525ec2c061", "value": 2451254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170558, "uuid": "0c682d08-374d-46fc-a32c-871850f6349a", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170558, "uuid": "5487435e-61a8-4658-8b65-836b297a1c58", "value": "domens.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca1ff65-3847-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776201484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201484, "uuid": "2eb9efbe-6400-4884-aa0c-95fefbfcf25e", "comment": "Malware payload", "value": "dba59d9859d89e6db6b1c8d4a7ec752a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201484, "uuid": "764560e8-c59c-4abe-be7c-2e2ccc1d80ac", "comment": "Malware payload", "value": "349dab2f8a35fe80468fa12d155aeddb9f81ae2b94541123e17e56b00e5e1df9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201484, "uuid": "c908dacd-ecda-401f-9433-01e2e171b42a", "comment": "Malware payload", "value": "9a2bf5fd73f28e18d712c0de271b4fe5fced0e61", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201484, "uuid": "e8afcb9c-6cc9-47f9-93a5-3eb92bafb5a2", "comment": "Malware payload", "value": "fb84e0c03dc581878e4bacf5b976886e4a24b4094160e57b5616a35d4adc1b183f62578320e789bbfb3a1cba6f8129ff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201484, "uuid": "9377c073-c44e-482d-8169-f6fa8c68105a", "value": "T11336125197C41FEEDAE94D3410F9345ED3F01ABA9467694B5FB33E4A2FA3880023AD49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201484, "uuid": "f9a4cb61-8a55-4f8f-9818-bf472b6eccc4", "value": "d9ea6fe6f1693e30c59fbbbe1b5f91d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201484, "uuid": "ce06453f-c1e6-42ee-aa52-096bd003e595", "value": "49152:Kg0ZAT3AOdLn3y7jr0xV0qnnjEHeALYKrrYhDbfmz9iVC9G:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776201484, "uuid": "cfd587cb-e9d9-4e22-ac25-e5888950423a", "value": 5161984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776201484, "uuid": "d8170805-7b9d-471e-9c51-77cbbc2bf1ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201484, "uuid": "c4b86d29-0334-4f7b-a284-00d6945ac395", "value": "crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bd22b9-3808-11f1-a769-42010a9c0008", "comment": "Malware payload (CNBackdoor)", "timestamp": 1776174303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174303, "uuid": "7f38edc8-f904-4bbf-8169-a037ed54be67", "comment": "Malware payload (CNBackdoor)", "value": "f6e2a59c37f4175a3fd546e4b2d4e658", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174303, "uuid": "3620106a-bcde-407b-8bc6-0add96b41fb1", "comment": "Malware payload (CNBackdoor)", "value": "34c7d56bc43c8aa3b4c9c9f42fe85081830480430498aac2b3eff9f8c236c14f", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174303, "uuid": "c5e7c817-66a6-4f32-93e4-fa01796849e1", "comment": "Malware payload (CNBackdoor)", "value": "b7ee7d8e5f9fe3120b4e5c7a17bda745deb23a2d", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174303, "uuid": "9b612493-332c-4bbb-becd-a910c5462954", "comment": "Malware payload (CNBackdoor)", "value": "159df69c79eda505b4600acbe2e80c6b89d293cfa53c36dfcbbd11d0bc69249eb2d76e3e51a372867b68b95fef955ca8", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174303, "uuid": "98c4f55b-6eed-4a33-9984-c841ba88003c", "value": "T10CF63330E6190C7CD54E6576989AF0273E5AACA200DD31E5336E3EA34FFDCA6C548A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174303, "uuid": "8ed2a940-0aff-4d70-a7d9-deb7d267a455", "value": "393216:aNTVfxopTLCVyd/OYWan+Vpre09oQQIGJqumhycjk5dhHK1zbTn:atVfx2TLCVyd/OZpi02QvHjwnhq13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174303, "uuid": "20f70dde-7983-4eac-a786-0fe5801641f1", "value": 15429632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174303, "uuid": "a89668c9-92ba-4786-95a4-452456b0d69a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174303, "uuid": "16967a2d-b7f0-44e8-b16c-ecd0d1d312d3", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f44206c-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127212, "uuid": "3b82e1a6-cbcb-4ed8-bf70-949dfb788bae", "comment": "Malware payload (Mirai)", "value": "2e7953d4b213cf68b4db9b8492e56923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127212, "uuid": "008492cd-a3b4-42c7-9342-c552f49fbcd3", "comment": "Malware payload (Mirai)", "value": "34ca536b0a1bcb24e70a5a9d50fd9181a4e65915d10e79aa93f0d2cb71736e36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127212, "uuid": "6b8fadf3-75f6-480b-a6b7-1003d2fb0521", "comment": "Malware payload (Mirai)", "value": "a505b29f0cfadc28e397c301297ae278f28f2058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127212, "uuid": "f6e44b4e-ca4e-4034-a34e-d1383d7c30bf", "comment": "Malware payload (Mirai)", "value": "f0fb18eb53cf4148dbaa6f0f394967fa52282fb2953bf2bba26d588401b2436786a0154ea136ab614a11895caca348c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127212, "uuid": "1f24e69c-8ea5-4dbb-a88a-e8432519f8d0", "value": "T1DE932A85A393D4F4E84319B001EBFB396A34ED331264D95AD764FFE2A9236C26015F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127212, "uuid": "13fe32af-886e-479b-9356-57db588772d8", "value": "1536:Fnn2aEkvZAL+hZhKLPZmcptpeSO27wfwTMUt31ZXQfdWXBr:2wFhniPZmMpeSO2xrXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127212, "uuid": "f9e72e10-4381-4544-b4aa-037521ac95cd", "value": 94508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127212, "uuid": "6e5781ef-9126-4788-9ff6-6593c160aa0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127212, "uuid": "65aab122-3717-49d0-ab9b-a00d39ad3d69", "value": "zyre.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77d1e85-3825-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776187114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187114, "uuid": "8982b655-1c0a-46da-8314-f806210b12de", "comment": "Malware payload", "value": "eb132a20ea1aba095b16023f1963e94a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187114, "uuid": "f26d24ae-f892-413b-88f8-7c1a26a86fa9", "comment": "Malware payload", "value": "35cf37f1c6425ebb9015371ce1efcc4e57fbda3541d3437f0d684149173f8bcd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187114, "uuid": "64c33f62-1ac3-4f3b-9bb2-7948d3f23390", "comment": "Malware payload", "value": "8973cd9073ced9caa0aca8ffbb8cbedf3aa5205f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187114, "uuid": "7c965803-a497-4d39-a54f-872dbc6e4675", "comment": "Malware payload", "value": "fe1855f75ace36d7e3e41adb6469826655529558d61ed3218b27f943930167956f40b3a116c898fd42ea006bddd65c18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187114, "uuid": "1767db8e-5ee2-40fc-9a18-b36d51561909", "value": "T173F54913FCA519A9C0AAA23189669252BB31BC491F3123D73F90F7382F36BD06DB5354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187114, "uuid": "74302e3c-86f5-4094-9b7e-c9fc49d3429a", "value": "49152:JD/f536yW1P22z/rNwx9qCvAQp+JAxj5ES3viDHE6cc:JDFpQLAQgpbx5aDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187114, "uuid": "e526046e-cfb3-4242-b588-fe785e8b372e", "value": 3473592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187114, "uuid": "af332c44-1ba7-4639-8322-4f0e7deba200", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187114, "uuid": "1ab8dac7-1aec-4131-9bc0-6960ce16f567", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f739e063-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149747, "uuid": "dab69b60-97ae-4a82-8bf4-5e0ac10124ff", "comment": "Malware payload", "value": "f371f619d135cd5316fe65204d991b87", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149747, "uuid": "12ac6b5e-f25d-4c45-a41a-074d78adfa93", "comment": "Malware payload", "value": "36a143a0384cbe84d717eeee5fd160a9f608e09dca234dadc3475cb7e85facc5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149747, "uuid": "d7c63e95-86e0-472e-938d-a6d32d8b9fa0", "comment": "Malware payload", "value": "b4327b157aa2e7ca1061d7dc946b71abd01a176e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149747, "uuid": "5296abad-6a86-416f-9e3d-c251486d479e", "comment": "Malware payload", "value": "e1a356551cfcb46c7c3eb37e61bc2fa21e56ca822c9dc078479d0059e64fee83b0d988e004b86b6e66d370b8a6aa286d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149747, "uuid": "1a7ee084-bcfb-403e-a8c3-eaf7f7e6aa6b", "value": "T107C5018610886C28293FBA50DB010E02FBD7E95EAFDB9DDD7191C3E5646B51DC8622CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149747, "uuid": "2a6818f9-db24-48b5-8fe1-b654b33c5d74", "value": "192:EYJSDEJJYDunJEYYYSDPDdDSYNYzuIYIDJueDndPDJDEuCYnuEYIDDY3JYYduNDM:EyxvKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149747, "uuid": "7b99301a-41ce-403d-ab00-8ab07f805bc4", "value": 2718673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149747, "uuid": "e8811028-9cfc-4705-bed0-722f8d612648", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149747, "uuid": "87379eb6-f45f-4d7d-817c-1096e8ff2e95", "value": "4201022043.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73bb83b-37a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130393, "uuid": "bcddd0e3-7a1e-4f8a-a0c5-bc1b1a8072b6", "comment": "Malware payload (Mirai)", "value": "577812a8d7c33ca1a5c6371d7b52af5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130393, "uuid": "4e894f95-1b5d-44a7-8ad2-ab639eb86c2a", "comment": "Malware payload (Mirai)", "value": "387cf666ed7b2bd3e77fc5310b1799625a37699342ef85b96f9bc7a34eeb1853", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130393, "uuid": "8f54c647-009a-4534-8ce2-55516f3b2fbd", "comment": "Malware payload (Mirai)", "value": "3c5f48c6495a8c2c449d28c37114b77cdceab52d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130393, "uuid": "7eef01c6-3748-42cf-bdb4-f5ff71b5843e", "comment": "Malware payload (Mirai)", "value": "f0928acfb06ef7fea5ff824fb6665d54f059e0c41041bb5f3fa3080ef33fa2f90f546ecb14c622903316b6ae81038ce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130393, "uuid": "3afd1b2e-e385-407e-9e07-c3433fd59dce", "value": "T178F2F892B8929D26C6E4237AFAAE018D336163E8D1EF3217DD211F047BCA51F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130393, "uuid": "00f70030-8e53-4cbe-a383-685639fcd7d1", "value": "768:awPX3fF7ugIpYqaHPkL7uKMlnhEXC8waU0eCSCcdTD44o/H/NPN:aafFygzFPTT8w4UD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130393, "uuid": "6012113d-27d6-43f4-bf00-7f57e57d82f1", "value": 37152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130393, "uuid": "6ca243fe-85ae-4d0b-a332-8b33547deadd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130393, "uuid": "6f5b3420-7537-4a85-aab0-c8e3dc3329e6", "value": "0uparm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd88ac8-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157620, "uuid": "a08106bc-fc9e-4505-992e-4b3764a99a9b", "comment": "Malware payload", "value": "58ea6b474fdd10026bbb7b417fd855dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157620, "uuid": "652801e9-f092-4558-b15e-564aa7119c22", "comment": "Malware payload", "value": "3a221534de0d0a7b0536174ebd75d41b416f49a66d0d69627c1939515106af2c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157620, "uuid": "735df553-cdc0-4716-98bf-3dfa2a87f0b7", "comment": "Malware payload", "value": "d4cbbae42f7b8508eb320a6dd3c628c08a16e3f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157620, "uuid": "419c23f3-db1a-4369-8818-3c7fb0a05587", "comment": "Malware payload", "value": "d29f7ac6c116087decf70dbfce7e708233c7b9c666e68e349a4bc45fc6a9ee7c764cd74517bd8cf0d363b3cf33c640cb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157620, "uuid": "49ab090a-996a-491a-9d88-5109e26995b1", "value": "T1C9A68C02FDCB50FAE9031E3005ABA23F63315C064F65EBD7EA407B29F97B6A51936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157620, "uuid": "fa61f5e2-e963-4546-b0cf-eee84e21aa80", "value": "98304:slboVPagDPSBPmRZB9/MCvRgmkzr5EE6MnZ0Pkkjl4HunywM1QQC:/sgmZmRZB9pvONra7dMcl4H+ywSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157620, "uuid": "d1eb295d-52a3-4291-a7ed-6c260fbaad94", "value": 10269017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157620, "uuid": "777fe838-0388-494d-b788-34d52290a94f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157620, "uuid": "2ca62b9f-9ba1-4238-9dcf-7f4c37944160", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d28214-383f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776198244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776198244, "uuid": "3ea92b0e-674a-4105-b10f-c756992e5048", "comment": "Malware payload", "value": "11f07c5b54258cae3e7119b0d1c53717", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776198244, "uuid": "846036de-c899-473b-b72c-987f3a542cb3", "comment": "Malware payload", "value": "3ab2f4ff3ff610c1abcd3733e3f608d263f4a196b23620e654063f8133f5b340", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776198244, "uuid": "9d064407-d97a-4515-91f4-0f904a2d9833", "comment": "Malware payload", "value": "a662c414da3e9ff7bfe8150328a1fb5a1d9c9655", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776198244, "uuid": "4d7cce3e-8736-41a4-a6dd-243ad50fba51", "comment": "Malware payload", "value": "7e2ab804f351a3cc4bf9ef5a166a5823ee288ca4297ac73b68138e28da7e12b1d66fd6e36ac052025eea5d1e72f21761", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776198244, "uuid": "e7c40daf-743c-4726-b792-093998eb17ee", "value": "T10214D019F1A36B7B4241EAF570FAE1FBE481332A6C8334F6476D5709DA011D7894AC47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776198244, "uuid": "b053f573-c4c7-486c-aeb6-a57252222347", "value": "6144:29rwLtlo6Zc7HGxaQHfAJaV5DwOX/vIQJ5BKifk:Jlva7HZQHYEDlvbXBK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776198244, "uuid": "819ba4e7-d775-411b-af72-673254e8be8b", "value": 205626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776198244, "uuid": "f10ad82b-c29d-40c2-82a4-e36965785aae", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776198244, "uuid": "b9950171-4ff0-4392-af6a-dc1c059d5cf3", "value": "Risk-Brief.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93600ada-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130682, "uuid": "7a2803b5-7cab-41ca-92a8-61825ac771c2", "comment": "Malware payload (Mirai)", "value": "048b498c1d18a3665c0488ee5cccf186", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130682, "uuid": "b9b6e766-39e8-471b-8a1d-076a0b7e760a", "comment": "Malware payload (Mirai)", "value": "3c4a13486295532ccec062b98fc88afb4bccdc072bf9843b46243f6f9c1e80ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130682, "uuid": "dd4596b4-a9e5-4604-9fe5-79e98baae041", "comment": "Malware payload (Mirai)", "value": "b5dfed3f8afa77290978ea25cc3ba190371f7879", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130682, "uuid": "ff5f1afa-7f02-4ef4-ba65-fbe86a661930", "comment": "Malware payload (Mirai)", "value": "2dbf02d7bc2c8f7c2d4c36c80484cb59bbb37f8b55030f5949f81b950e80e0a2d85a33df5e7854cfbfcc53d298b7d2a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130682, "uuid": "17f1c134-e3dc-48be-9119-4d9993a3cef3", "value": "T168035CC8B903DDF8FC1606F42136F77A9BB6F07A2128DD97C39995339C42A05A6062DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130682, "uuid": "1d111ea9-ea1f-4e3e-9b3e-01b04eb88e9a", "value": "768:wZT8epBPi4gJW0KMcjp49A9/YuEGV3qenNEgouBnk6PyJiE9Ee4V:wZIezPi4gJW0KMgp49Ax8WlNFxBnk6P4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130682, "uuid": "f45741e7-e434-4cca-a2e3-3634808db5dd", "value": 39356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130682, "uuid": "b24ba54f-e1be-4696-90a7-3955f21a080e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130682, "uuid": "d05c736e-a906-4add-8b05-a82797e30eab", "value": "0upx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4116eb-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149651, "uuid": "501dd3c3-3cad-40af-96d9-dbba5d3f175e", "comment": "Malware payload", "value": "a51ac08d9fab5ef6b2904ad62cd68e37", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149651, "uuid": "0a02ce58-2bc8-4e09-90e9-fad684067f46", "comment": "Malware payload", "value": "3e0429ba1bb7bb27751b7bf7d1f6c9561ffe5dcd41dd9ef7ef6d17f0b0a29b90", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149651, "uuid": "c486df09-bd78-4768-8061-d201462aa53b", "comment": "Malware payload", "value": "84bca01f9b1b14cb664486137832b97144e823c9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149651, "uuid": "62b46a00-7462-41ec-a1f6-f3e6c422f10f", "comment": "Malware payload", "value": "a1171418ae7c2579268b859a1514a64d532f413926ec56f8d535f553c5a733cbee050fc50ce953971001d352d8df03d2", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149651, "uuid": "db8b2e55-c819-475f-a9ad-35c5d618b78f", "value": "T1D6747C6162E9242BB9F33B24A8B52085C69FBE139F5B841C109715ED47B09808FF57BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149651, "uuid": "b0e5bcd8-3046-4fc3-86a5-d1a3393fd386", "value": "6144:f/yMXwCGjDm2U4F7JpmEngGyDanqI9cbeOaRcPgBQcTM++uPK1ODZnGj1kzxI0NP:f/lFGm2XJpmEng/Dan3cbelOPgGcgmPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149651, "uuid": "15ed27d8-9b53-46b6-a699-eff372bd1ede", "value": 356524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149651, "uuid": "e5f9f901-8169-4c52-b347-cc61b304158a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149651, "uuid": "2622c4ec-5cf3-4ffd-a689-95153608c557", "value": "PO#MAIN450000000227897_Sraco_Doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80382e65-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162432, "uuid": "d172d061-dc89-4e0f-9ae6-775aa4876c13", "comment": "Malware payload (Tofsee)", "value": "f70266a54b2e95e3cf8d613be904f86d", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162432, "uuid": "1214f286-9bd6-4c65-872a-b902dd08dfd3", "comment": "Malware payload (Tofsee)", "value": "3e65e37f8f7f27b1bf36c932fcf583dbc9c250d5df90b8d7d842e1d8a87d1091", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162432, "uuid": "def79d41-a215-4606-b8db-cefbfcb0f600", "comment": "Malware payload (Tofsee)", "value": "865e19499fd76ae408d5e39209031b7e8a54390b", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162432, "uuid": "c5c82a6c-6b17-4878-9cc4-129cc332efdf", "comment": "Malware payload (Tofsee)", "value": "7fb4fd17b7c910c700182f30d920a0287350fdfbef4845584f877ab46f6110ee34d08aab3f8aa078ffae11b8e807f8e4", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162432, "uuid": "18c10118-4723-4448-9014-7fcddf07307d", "value": "T136737D17F1D1E073E2E3027072A52B269BF6ED76253EA8C2D7164D815FA59C1DA2F203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162432, "uuid": "8a0ae48e-ae80-4f84-8217-3dac851424f1", "value": "0bdef4d92a94790d7d279561a490c5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162432, "uuid": "1141264b-0ac4-45dd-8710-dd927178289b", "value": "1536:Q8ls2sYCn0PWsvHs0f4agFzOJkwG/etpdpIXrc5Uc:wYCnnsvHsM4haG/wXpIXrcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162432, "uuid": "ebb3ac86-058a-4c3f-b205-e14597aab7f7", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162432, "uuid": "f7065bf7-3442-4098-8fa3-fc1aa6a92eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162432, "uuid": "55db113a-cc8a-493c-a5b2-d1e761d3d7f7", "value": "3e65e37f8f7f27b1bf36c932fcf583dbc9c250d5df90b8d7d842e1d8a87d1091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47445d57-3812-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776178658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178658, "uuid": "31fa161e-f374-47fd-b418-698d89446e1e", "comment": "Malware payload (SnappyClient)", "value": "bf884691b6fcfcc4ee0f80b782d7e9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178658, "uuid": "cbc69d56-8260-442c-ac2e-a11ee74fca4d", "comment": "Malware payload (SnappyClient)", "value": "3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178658, "uuid": "889aa9fb-d911-4df4-92db-64d45a5f0159", "comment": "Malware payload (SnappyClient)", "value": "27b203af98ba343e993cd56fe07155c3e33af4cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178658, "uuid": "88b5d011-0ee7-44c3-9e68-9814b2aa7f47", "comment": "Malware payload (SnappyClient)", "value": "0985c6d53fadfd65dfae667f74fe99b9553faf36b988352f45a9682d507d0c74eee0613ae5f0d4d5491da2b519f1ad13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "xx-kak-is", "colour": "#B502AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178658, "uuid": "f7d8f0a0-c578-4516-986b-74f1fd907095", "value": "T12076233291555133F6F505B7AD2862303EACA338276048A9E6E4DD0D7EE88967BF3347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178658, "uuid": "79b28e0c-ac16-4b73-bc59-09a7f8bbfc1e", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178658, "uuid": "72b48d86-16da-4ad6-a76d-b9f25bad5be2", "value": "196608:8fUhLtyAwqlnUQ0YemmcwXnRAK108fm5NaMtS7F+7TB0QFOEwCdohSp2jGx:MwtyAwi0Y/FInaB8+5NPS7FwaGMjRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178658, "uuid": "1e5fecf8-35ff-49fb-bd30-c9e1bf83ffd3", "value": 7826714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178658, "uuid": "be185280-61ec-434e-bdb2-9af260f86bfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178658, "uuid": "65475de3-4612-4c1a-a6fd-a8556ec8a649", "value": "3eb8dadd340292c43785600e0e003637e621d6e5a2d5934fba4e5590cb65f8cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d27ad8-3823-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776185982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185982, "uuid": "e60274b1-198e-40a6-ae0e-0b5b7512a351", "comment": "Malware payload (Mirai)", "value": "99c71572b28a1745cf3cc94cc9d382e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185982, "uuid": "dd30e9e5-3345-42e2-a8a6-baf703783138", "comment": "Malware payload (Mirai)", "value": "3f2f3addbd402c4953731f0212b74360ec1aaa370f45f20df28b081d73f111aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185982, "uuid": "6553a98f-03c5-4034-a860-987fa7663c32", "comment": "Malware payload (Mirai)", "value": "8582a47702f4d7b24845437418f5217e935014d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185982, "uuid": "e4399d68-e6b3-438a-a01f-9d64f08d2aa4", "comment": "Malware payload (Mirai)", "value": "4b5c1316a46be2105f8e3cf13164bfb2637489e796e546ddc0b69a7f9d76b42df97dad06f31260d4927efe6c873335b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185982, "uuid": "26d9e26a-77be-4636-b75b-a59e6b088f0a", "value": "T132049D33D4787F94C564C470B0B19F781B93A5A481970FBF5AAAC2B54087E88FA097F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185982, "uuid": "6dd04e03-82d5-4553-bc08-4f45bd4116a0", "value": "3072:s7zugOIRqLT9RFeRMSDJjwaA0TROEoO5uOWRUU6OLD7:s7zoLBmwaA0t/ybROOX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185982, "uuid": "3c2326a6-12e2-4616-b009-f6e60333d882", "value": 175272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185982, "uuid": "6cf30b71-1120-4b94-8f3c-691ed1d1c1c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185982, "uuid": "0eafd2ad-0061-4464-b367-02bed677293f", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d31c9a9-37ac-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776134832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776134832, "uuid": "e50d1abf-1c75-415c-bd5d-3677869e5808", "comment": "Malware payload", "value": "778129d666a31ee75328ed50be86a6aa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776134832, "uuid": "a337aee4-a528-4acd-8a41-1eebcdcbecbc", "comment": "Malware payload", "value": "3f345775f6eb3fd8533ede6fbe49f26a3e5294818a4b26f6bda9e8131ab6bb25", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776134832, "uuid": "896128d2-9ba6-4a09-9aa0-f0a324f3f9e0", "comment": "Malware payload", "value": "e54c5c599426a469c4dc84632c1543d28d17af32", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776134832, "uuid": "9a249ec4-a94d-4e21-99aa-5de9d217f556", "comment": "Malware payload", "value": "961cd5cb0bae705416e676469660b4bf302275af20f40f9047b64a1cf83826e912f2a8ca05ad0a4cecec88124caacf96", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776134832, "uuid": "034ea2c0-ee59-438e-83f2-5dd71c348d8e", "value": "T110F046DCE1BCCFA219ADCA89F6F05544549190C7E0F56BDAF34E0820AF04E4A3A6334D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776134832, "uuid": "5ce8b041-3a02-4ec5-a29b-3e434430fe22", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkYBjasQKGwnv:FzY8k1/sWi2jkE1hT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776134832, "uuid": "e5eb4a85-efb1-45dc-95b2-5dba09ea824c", "value": 654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776134832, "uuid": "41db2783-d34f-4067-a4c1-8f75d9c65b5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776134832, "uuid": "6c8ad81c-e952-422c-81c1-0ff010075c2f", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38506baf-3824-11f1-a769-42010a9c0008", "comment": "Malware payload (SheetRAT)", "timestamp": 1776186363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186363, "uuid": "5fd049b4-a5cb-48d9-ab87-c345bfd022a1", "comment": "Malware payload (SheetRAT)", "value": "ae5058cc79e51fe27f6e666362cb76a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186363, "uuid": "3374c20c-20f9-4177-8c3d-7a8baba7a958", "comment": "Malware payload (SheetRAT)", "value": "3f7552684f1f8547631e002bbf97058e6ee79408855104770cee7d1825aababb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186363, "uuid": "ad77aa84-1c3a-4a15-ae9e-f8004b1b339d", "comment": "Malware payload (SheetRAT)", "value": "de75aaf9a37c0d33c3cfa931f8fc6f7fcf860a38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186363, "uuid": "c3f0a401-ccd4-4e1f-bd8e-0cf3088ab6da", "comment": "Malware payload (SheetRAT)", "value": "4ad16919f0ecdd5a4fe4193af341092c6af48fa598e245d4cfa49e0d88d91667d79857683cae0981d46e2ba2fc201f1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186363, "uuid": "94dee9c5-bdee-4452-a0f2-e0533029a2e5", "value": "T1F785C73417928426E1522B780971E3F9D7146F90213AE327BBF39DAB3E091A7BD497C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186363, "uuid": "96ec4888-a570-4d24-9feb-d4e621cf4509", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186363, "uuid": "ad608062-135e-4221-b1de-0e0d2901d719", "value": "12288:XeeNSm4cGQ1OlN3CWIwWh8cKy+LeFcjuoYplgJablD:weGTBSw1LApzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776186363, "uuid": "30eb6fa2-de5d-4f0f-bc80-e077c44d19a3", "value": 1755928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776186363, "uuid": "f022b432-e3e0-4a1c-b29e-bc30e65f2de1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186363, "uuid": "b37eb0b2-dcb7-460a-b7cf-4fb2a131938b", "value": "Solara V3 NEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f8501c-3858-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776208779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776208779, "uuid": "06fee666-9347-4051-98eb-b067127f6fe6", "comment": "Malware payload", "value": "dc96668d007df0a545bf1334e10e80fa", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776208779, "uuid": "ec917451-41ce-4695-a5f1-d672b817be38", "comment": "Malware payload", "value": "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776208779, "uuid": "49f6e272-d4e1-41a2-aef6-1a77c701869b", "comment": "Malware payload", "value": "48d4872e8463d1ede1b93e3f6a6a8cc8c2cecde3", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776208779, "uuid": "2dc84a14-32c4-4584-80cc-5e6958335c10", "comment": "Malware payload", "value": "a46cce7f7c3aabc61d54ee1b006fb94ec08e58f3294ddc2f31c500b107b9641d01e3ff96b76ecfd674248d87d1487bb2", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776208779, "uuid": "07396d36-5245-43d6-8470-f3b5713b5bda", "value": "T12255331777281C76E5D0D23BE42266AEA1A81D25FFFB867F129D714742B1CC85B288F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776208779, "uuid": "37000442-9622-4815-8656-79e5c8669249", "value": "24576:lvC0dkQlvjqIFfQmvBQLkBV31t452SmN6kbbU2MdXdb3PsXwevwSwmavUrHIA:51xjLFfQnQBN1tLSmNMxdbEAevwnqDIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776208779, "uuid": "3aa4f5bc-157b-441e-92b1-c95e84486206", "value": 1298432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776208779, "uuid": "c9bfa6d2-1e18-4ef7-b319-5c81eec55584", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776208779, "uuid": "483a2f58-9d0f-439f-a730-fa39d7efe340", "value": "update.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc35169c-3822-11f1-a769-42010a9c0008", "comment": "Malware payload (Koadic)", "timestamp": 1776185779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185779, "uuid": "da4d5ddd-8e0f-4678-8b7c-7c6869185904", "comment": "Malware payload (Koadic)", "value": "61b5471d34afe91a2f0941a002703f08", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185779, "uuid": "4f67cf89-954b-4041-8ac7-5e9c104dd446", "comment": "Malware payload (Koadic)", "value": "3fa264b936c1c55741804d8a939adb64a6bd538ccc160f6dbbc47031b2ba48c4", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185779, "uuid": "d7704db6-72d7-40e3-836f-27ab175c6b16", "comment": "Malware payload (Koadic)", "value": "c29c52c25c92430dfff2b99197a7ac0bf62bd254", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185779, "uuid": "97e8a568-9ad7-48e0-8d5e-1f5432d29ea3", "comment": "Malware payload (Koadic)", "value": "189a4f12ca1e2f2c518c27559040325cd71008e43a293ba70cb21b4e7763c3da7e7de3cf77089555ad76385dd635a0c2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Koadic", "colour": "#AC430B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185779, "uuid": "ceeb6478-cdcb-4ad4-b40c-baac34284572", "value": "T129F1A1AF088B534730972961A39C6902972DB8BF05268C7E050C7E797C953FEB11EE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185779, "uuid": "259c6ea9-7b8b-4c01-8d75-031532d0eb1f", "value": "192:9eY1EsviErGQU/PZY18za1VWbM8QkLHIUCu5lR9o7285JTHkD1sQvKE95Xo7y01X:+/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185779, "uuid": "56a5ec49-ff20-42b9-a8d4-02d76c67ff16", "value": 7512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185779, "uuid": "f046c4f5-824f-4fbb-ac0e-e0e38d48965f", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185779, "uuid": "93d366c5-ea93-41e0-a8f1-8042abb3b408", "value": "start.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4883ecfb-3827-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776187679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187679, "uuid": "5d8b2c11-0f8f-401e-a079-a59cd03183f6", "comment": "Malware payload (Mirai)", "value": "55b7f6b2ef85ccc7ccb1343fdab61eae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187679, "uuid": "37dd975b-b6d4-4d09-8d52-42c69db980db", "comment": "Malware payload (Mirai)", "value": "40306da8773983a835c8f4f1a53717c8927974b9ceade8cca31aeed1e18200aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187679, "uuid": "6c4dc22b-6b7a-4802-babf-cebceefc1232", "comment": "Malware payload (Mirai)", "value": "f38bcfd6184584f52f8f8888dd9fb6312bf69eb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187679, "uuid": "b3aff039-7d77-47b1-b063-f72d492506a2", "comment": "Malware payload (Mirai)", "value": "11ff9365fdef1d4cbf89d03a9a83094ecd8dadd3b41be7e54c2494c3050614f86c972a6d3d31453de846d779185ae7fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187679, "uuid": "d0ce06f8-5fd8-4ddf-8064-58f7b45bd3f0", "value": "T17F44F906BF610EFBD8AFCD3706F9170525CC641B26A52B3A7674DA18B50B60B0AE3D74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187679, "uuid": "2ae69b4e-b520-46f5-ad33-b5170521783c", "value": "3072:DWb9L4iRAcZBB9p3632mffUdr+P45CSnKIrGFXDYwVYR3L:yb9L4iR5bBP363rfUd/PTrgD7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187679, "uuid": "188fa002-5aba-4c5b-8ecb-723d18763330", "value": 259264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187679, "uuid": "d3de9657-5789-423c-899c-27e758d3450f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187679, "uuid": "23f6dffb-3396-42c2-81f7-55bbe38b08c2", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb9f3c8-37ff-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776170538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170538, "uuid": "ca42ed34-e176-4f03-846b-7d8684704d8b", "comment": "Malware payload (SantaStealer)", "value": "606afecc4dc7e3467e29161636aab4ce", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170538, "uuid": "cb0b8f1a-391a-4c55-afb0-1a181a72f357", "comment": "Malware payload (SantaStealer)", "value": "40b36d05de040e006567ed76b788aa25790b41ff6fc54567bf4996f4b7a89fcc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170538, "uuid": "5dfb1c93-fef1-4f25-9739-9241f2049856", "comment": "Malware payload (SantaStealer)", "value": "b90cea1d348ee3ad12ec34b8391593b81b89b26b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170538, "uuid": "9100db21-57c1-489c-819a-aff59f30970d", "comment": "Malware payload (SantaStealer)", "value": "02468af1ac354b1e4367f3220cf9917b8f1930ba420fef19836a911e1b849f64d7d076e894ff0761c398d8c611199439", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170538, "uuid": "ebcc66ae-29a1-40c9-8a5b-dd94292a08c3", "value": "T121A523017A080F93D41190B2B47FAA305E399DB432BB2D72B4D9FB7F6CB199986974C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170538, "uuid": "16fb017c-3da1-4976-8c96-35f7391d9f09", "value": "49152:fNHKfGiSt2jDmxJC+xxsP7OOKZ0HtJZeUpt3mw5R5PqHnrSuAqK9S:ZkLleqQxVINTe82EWnuaK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170538, "uuid": "2100161c-5019-4b55-b878-0d2eab352d90", "value": 2199552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170538, "uuid": "3004c035-5ea9-4422-b410-97344e1aba70", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170538, "uuid": "a609cd5b-dd5d-482d-9e1f-ba416403c7b7", "value": "Loader.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c79e2b-380b-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776175670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175670, "uuid": "6ded5cd6-c9ff-479b-9e9d-81ddaddf3f95", "comment": "Malware payload (QuasarRAT)", "value": "54581a62580e658ad39165a8a1f6322c", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175670, "uuid": "fb3564c2-7491-418a-938e-b2cc697eeccb", "comment": "Malware payload (QuasarRAT)", "value": "4259fab18ffddd4b40ca3097ddcf8a08d11c05717f975c50925d5670c0272ef2", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175670, "uuid": "72872e75-5087-49ba-86c5-cf1772ab57e2", "comment": "Malware payload (QuasarRAT)", "value": "49d1dc112e7020287d9768a8dd6d0dda1b40aabd", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175670, "uuid": "1752da82-f09e-49ad-b044-22dd65470879", "comment": "Malware payload (QuasarRAT)", "value": "e1edfeccc930d156774e7e8f029682d976821deb18a2a6e223048cd46864b64024b829da4ee7d1a3b0510c90807933cd", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175670, "uuid": "182c1ebd-cdce-4755-9a70-a213b0a7bc5d", "value": "T10241F11AB94956E9804B5236ACE756023E9E506F111E9820BEFDC0C5BFC1E6FCFB1468", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175670, "uuid": "c667e157-8610-4772-a963-4a0c24ae0319", "value": "48:7qRivXobo+GyUSnt4M9JVm4BKpCmtM9h4BKpCmUCo6jnQrcrA/h+glAfpmfYmvn:uRgXj+GhStFVuopoQxdcfDvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175670, "uuid": "a6b26f10-4f4f-4578-8965-e2ff5a9e61bd", "value": 2272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175670, "uuid": "b6d7d531-7272-4c78-9e2b-d5cb7653c00a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175670, "uuid": "0862c485-fb2b-46c5-821f-6577dfd6fd3a", "value": "start_qsr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c45bd1-3849-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776202537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202537, "uuid": "4ff9cab0-87b3-471f-87a4-b25d18d31ad9", "comment": "Malware payload (RustyStealer)", "value": "2ecb0eceecbf53b762d882a71a34a7f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202537, "uuid": "069e0618-483c-4344-82bb-4c36b33f5699", "comment": "Malware payload (RustyStealer)", "value": "44946dad48f01fbc08571789b5d7c2a151ff0d6e52f43e53f4005fd4fcf8e316", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202537, "uuid": "039b408f-f906-44ef-9208-6391c3585d76", "comment": "Malware payload (RustyStealer)", "value": "b32e1301666699d83b21796f86d7bb04536145f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202537, "uuid": "96008fa2-cbb1-4d86-8f11-d41db8c1d67f", "comment": "Malware payload (RustyStealer)", "value": "afedd55cb56fa659572d329f55ebb9cb5359529a236fdeb4a55caa20956b077cb377395c79faa30e9cca914e552917ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202537, "uuid": "41ace1c4-a627-4d2a-9321-8405faaa1085", "value": "T1FA083343FAA651F9C1AAC039861B2233EA32788E072177EB56D486253F52FE01F7D754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202537, "uuid": "6f21e2b6-71e8-49b5-be15-e13088e455d1", "value": "44aabc4691ccc4615182b07bc91e6164", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202537, "uuid": "cab304b8-5ebd-46d0-b914-c105ebcb062a", "value": "1572864:dNd1Tq+CsaySHl7MhOFb0j9JzFl7cgtVzj12ftaa3wHprUWMX7hS26dhhYL/Yj0D:d1mP7ySFMhNzFlVVzYnwFUBdGdhhs/Yi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776202537, "uuid": "042e7387-df1b-49a5-8f94-338ad30573ef", "value": 83893512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776202537, "uuid": "8bf852c0-c082-4b1a-a984-b3a106e0b5b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202537, "uuid": "fee864f5-c941-4e8c-8a87-77a331dfb585", "value": "RtkAudUService64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630ee2a5-3829-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776188583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188583, "uuid": "b8f2831c-d9db-4028-aede-1d1d419d3222", "comment": "Malware payload", "value": "2b62af8d6bc39f8368fe01d7eac56fd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188583, "uuid": "daa84aa6-cdcd-41eb-a72a-a1b3e5b7e87d", "comment": "Malware payload", "value": "4519346cfce93d14893260d2960def18920b0658863ba4cb267401d1f9446a36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188583, "uuid": "69deb64a-1fca-4c6a-8a5a-f990cac6bd6b", "comment": "Malware payload", "value": "874d52b536ded8be5e96d4c46563b30142a7a1aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188583, "uuid": "886c0208-2001-4bbb-839c-5943e32344cc", "comment": "Malware payload", "value": "ec112354713edc2534c4f094c1e34149e462a106eec00171f88a3c91a57cec47338f71e87eeb27a236593feb2b7a743d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188583, "uuid": "ca4ee998-56f1-48fb-8e5b-9cc749e90ac3", "value": "T12C25F747A89550F8C5EEE174C7299213BDA13499073437E72FA186F11B26FF86ABC324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188583, "uuid": "d66d762f-2b66-44c0-a43c-6e24885187f8", "value": "24576:s4fJtWNg5HDHgZrb/TivO90d7HjmAFd4A64nsfJm+pskbwT:sWJtAgZD0rb/TivO90d7HjmAFd4A64nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776188583, "uuid": "01a7962c-9c1f-4d18-bbc4-1f75035dc07f", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776188583, "uuid": "7b1624be-d6d4-4c2a-b1a5-90cd03431c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188583, "uuid": "9cb6e636-100b-4b0e-9200-28d1d7e43b2e", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bc0f86-37cd-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776149100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149100, "uuid": "dcb427be-6234-4f6f-84d0-32ad503879f5", "comment": "Malware payload (AgentTesla)", "value": "2aff2a568e9ba7fb5fc1b5cc50815a6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149100, "uuid": "598c2219-3085-4f6a-9675-ef1ec9a4d866", "comment": "Malware payload (AgentTesla)", "value": "4549500a13d2e4eea55bfb223df45847052d8e6a7d574b81a623928bbe344ed2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149100, "uuid": "929dcedf-98f9-46b5-87ae-4b618743ccb0", "comment": "Malware payload (AgentTesla)", "value": "f9298f730881f971751e3ebfa777812c9802fbff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149100, "uuid": "fa41acd3-0105-46c6-87dd-341aa8750cda", "comment": "Malware payload (AgentTesla)", "value": "dcee2c2c02f684d165aead30242ee159066347f0f019fa7863b3e3eab13e25c99b68720caa707512ecaf7931cc35fff2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149100, "uuid": "62635c2b-516e-4a01-a20a-9a9ee46ad8c6", "value": "T17265021585C83FB8CFEC5A1980FE160EA3B08E865019A94AEB73FD47FFB7A044117599", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149100, "uuid": "32196028-276d-450d-8655-e00bca9413bf", "value": "12288:jaz1YefSabmqhhLPmX5BQMSa6Y0tgGzGzIDWgkg+t0RH7M1tZIeG3GH79aB6Qlp1:jo0mB7mpixyCbn4x1tZI7GHp0np3oxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149100, "uuid": "3c941f07-7738-4cfe-a004-75076b064f9b", "value": 1417111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149100, "uuid": "002622fb-fccb-4c92-ace9-cedde174b17e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149100, "uuid": "393889fc-5b39-471b-af79-8baf727ad1d7", "value": "orden de compra.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97df07e-37d3-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1776151872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151872, "uuid": "669aa69c-2f1f-439b-bf81-22b822ce0311", "comment": "Malware payload (DCRat)", "value": "a901a440bd19ba9bf99d444362036062", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151872, "uuid": "b5957da3-7847-4d76-9a47-9e134e0ce84e", "comment": "Malware payload (DCRat)", "value": "45bf0ce8cfa46597f7466afaa64a91426305660170113af7ea6f6387cf2b0e38", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151872, "uuid": "1c8f779c-2abb-41de-9703-853082cc8d59", "comment": "Malware payload (DCRat)", "value": "c815a060208ba7c1f85d3209bfdb7d8b8f5f2a39", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776151872, "uuid": "fb7d95bd-9f23-42f3-8b2b-82868de64c59", "comment": "Malware payload (DCRat)", "value": "6d6c72596371ab8b517352666a10d10bf3a7963a6d3a50825b78fd15827f9bf423209dc9858dfee787db054266cbb09d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151872, "uuid": "5bc44a0b-69fb-4c7e-bc05-09d90ef926b5", "value": "T1FD354A027E44CE11F0091233C2EF458897B499516AE6E72B7DBA37BE95123A77C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151872, "uuid": "c6313f3d-d6ad-4073-8971-aa11949a1f9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151872, "uuid": "ed6dce9f-1bd4-4471-8e58-fdfb80fd5ea4", "value": "24576:nj9CHXePCLx5lqCwqq0zAiRNfqa/zN0VxZ3lRVHtR:njMXSQhN0Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776151872, "uuid": "e1aae696-d91d-4650-87ad-66868297f0b5", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776151872, "uuid": "b99d79bf-dbbf-465c-8f26-9f75e660de5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776151872, "uuid": "f1920160-8420-4e2a-af30-5f52ac074af5", "value": "045bf0ce8cfa46597f7466afaa64a9142630566017011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8734bc9d-383e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776197663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197663, "uuid": "aa9aea16-0fdd-4bcf-96fe-4b19af9850bb", "comment": "Malware payload", "value": "1207040277c40105e455b9cde5f15ad9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197663, "uuid": "d235339a-9db1-47e5-b023-13c33f0125a6", "comment": "Malware payload", "value": "4703fc9e7993241336e4ff0c4d1c7fe68ead31ae40317d027d3ef5267d70709f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197663, "uuid": "4bc331b4-ff4f-4543-945e-0b4763f6b64a", "comment": "Malware payload", "value": "723b56c29570c7c2f7775e2a7f51f5c7f229b760", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197663, "uuid": "881c2b34-a343-46ea-861e-00548e3d40b9", "comment": "Malware payload", "value": "2d9540c00b170c702224324d7f90142a710b57596d66d0305d8149f0c8de685d38c72c12c5e3e4a34886eb2c24f44347", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197663, "uuid": "cc64ff86-50e1-44a8-98b3-97d057903006", "value": "T184069E21B98AC136D62E4176A968EB6B65792FF10F7284C723D83DEE2E704C15271F13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197663, "uuid": "d429c96e-5261-47c9-aeb1-c7393166f2da", "value": "49152:PJmohlj9szAlopTyWD5+kEv53rmc39bfWW9CdDLwYj0i5MV3cQ3azCHknkQRAYYx:MoSTybkXc3NEj0Ck5gU94D3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776197663, "uuid": "09693929-bd4a-4ec8-9026-369f3b3d8e9d", "value": 3990528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776197663, "uuid": "c5252347-6433-47b4-a559-3f81ff8cd840", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197663, "uuid": "f7dd39de-e24d-4b47-8479-153f716b9154", "value": "Resource.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93352081-37f7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776167189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167189, "uuid": "8d40d74c-bb6b-461f-92db-dc44d874d55a", "comment": "Malware payload (ValleyRAT)", "value": "a5297f1c4391c921fef3652cb6cd9f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167189, "uuid": "d7270710-dc1a-4bdc-99c0-944ef2ad321e", "comment": "Malware payload (ValleyRAT)", "value": "47ff219e2ac2ecabdb035ebf98a7d7b2e91b8488f8351958deb1e06428550c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167189, "uuid": "250f8adf-e300-41cb-bead-2de6b99771a4", "comment": "Malware payload (ValleyRAT)", "value": "9fd3556f848fd47a521699bf29f6ab0665225b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167189, "uuid": "abd6790b-87d1-40b8-b7d5-2144f435f611", "comment": "Malware payload (ValleyRAT)", "value": "ca3f83110e9b752d204d3a47de910932baf0d47197658cb793968aebaa546ae93cadac8542f5530ee21c9ec8d868e87c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RokRat", "colour": "#3F471A", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.RokRat", "colour": "#42CA5E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167189, "uuid": "1b2d2b78-5e5b-4702-ba2d-58b90f292525", "value": "T1F9365C8E6B7E5395D0B7C1B4A3B38197E13178459B3066CB2384536C2A731F09EE72E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167189, "uuid": "b62f1475-5c99-46d8-86c5-22d0807c50ba", "value": "e85843a4bd8a25dfe8044d969f459792", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167189, "uuid": "073e8313-d3c6-4d9e-917e-2baac68c59a7", "value": "49152:jX2TF0y0mLDFbqG90pj+EmApvxXggxVPTgKGW8Jsv6tWKFdu9CSPTvG7+ApHFhhq:dRuIrOJsv6tWKFdu9CSiCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776167189, "uuid": "263c2836-a890-4ce0-9613-8f84c70b190c", "value": 4961280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776167189, "uuid": "48b437ad-7955-4e55-94b0-5533452bf1f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167189, "uuid": "00a4f951-29ce-420e-af69-50c194532ed1", "value": "4.14--\u6700\u65b0\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69c5469-3798-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776126526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776126526, "uuid": "fde11cb2-1b07-4fb7-92c7-1791d92181ba", "comment": "Malware payload (Mirai)", "value": "d74d209cf4440a55f41244707066b0fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776126526, "uuid": "e33abad8-6cd7-47ed-a2da-374b1b082066", "comment": "Malware payload (Mirai)", "value": "4829512beb5625824506c5117de05916883ffa24532120e7605fce73bf88e90a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776126526, "uuid": "b3016492-5cf0-4d73-804f-52f32eb5be38", "comment": "Malware payload (Mirai)", "value": "b9dc89d1e8cb8284d2cb9cb88b8094e122df3c79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776126526, "uuid": "603aeff4-713f-4202-a7ed-35a6210d4cb9", "comment": "Malware payload (Mirai)", "value": "e7a8880b3b120c3bba582e921ac90fd67ea461efb215cf3dee4e2b0b6457323cbf8d529b67c308248256a8a9c97164ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776126526, "uuid": "51e09089-8173-4903-8dc1-f78109d0bd90", "value": "T1008328C6BA83EAF2E84740F101BAA7365A30F93A0425D585F3B47DB2E9118D56F0776C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776126526, "uuid": "dde68cb7-fde2-477f-ae82-08905c338294", "value": "1536:455cN3dnohtfH7eEOrE8T1dMo3sWSMsZheUyTK7LBZT1gR:45WMtf7enrEy1UM6QU6wSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776126526, "uuid": "b53e963c-d3b6-4c5a-a3cf-8c47ba39645e", "value": 86312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776126526, "uuid": "a2f046fb-ffd9-4198-b13f-3bd5b05f4b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776126526, "uuid": "de0844cf-be15-4c00-9a87-231d70549c36", "value": "zyre.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978a779b-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130689, "uuid": "5e33f2c9-a47e-42cb-a800-39c712c7515a", "comment": "Malware payload (Mirai)", "value": "04afa4ecfc28d35bb2df5b720cf06e51", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130689, "uuid": "e554216e-1f5a-4549-a804-70c2870a7598", "comment": "Malware payload (Mirai)", "value": "4891d7468b29336cd35672a3d025f42b1181009a4658a1062607b7815b363efb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130689, "uuid": "22030916-5cfb-4f63-aba0-aadea6da47b8", "comment": "Malware payload (Mirai)", "value": "f584623f9fc6c3cd1aee054c9075c19675ecfc61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130689, "uuid": "c5fa48ae-f65b-4cf9-8244-bddad592dac2", "comment": "Malware payload (Mirai)", "value": "f730a263281a0914a9d8e7cc8b9c670a9081b445f53a0d89958ecde6f55cb654749ba52e84eddabd696cae85e74e08ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130689, "uuid": "208898d8-1b8a-4711-bd1c-e8651ae8fc3d", "value": "T1AC132A42322C0E5BC6A65AB0293F17E093FFE9A020F4F585655F9B868275F761087F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130689, "uuid": "b91bc85f-d80a-4bb1-bff6-afa4aee969ec", "value": "768:M2+mLyDPtK4waS1U54GHGeRwb55aesLpOdxJ8RbhooAUd7:9nyrt7waS1U54QZkYFVPAQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130689, "uuid": "49061e9e-9da5-4cca-890d-2e525bee4a06", "value": 41892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130689, "uuid": "9bb401b8-5218-451f-98c0-b5c6b85bb7f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130689, "uuid": "5dda3d7f-e5cc-4870-9264-391aebd3c7f0", "value": "0upppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d06165d-37cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149113, "uuid": "9417f255-d4b1-4266-99f5-c4690e1bbbe6", "comment": "Malware payload", "value": "fcc334489a3f99acb680c841e1d894ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149113, "uuid": "d997cc12-0b51-4145-bece-7f3c713fc76f", "comment": "Malware payload", "value": "4a3ac63a1b8ba244432488ee3e32ffcc23fc1761eae72a6faf1423a1d10f8d08", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149113, "uuid": "e2aaa3c3-f6a3-4a63-8ba8-ff219052d72b", "comment": "Malware payload", "value": "079c219b3606f0f9ea611923769a2e49f6743339", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149113, "uuid": "a5fb33b8-5c21-420c-905e-01dd14642ec3", "comment": "Malware payload", "value": "6814ad6df637768c7ee738639b21373c24d98936c8010446fc4adeadaed79f4388abe261840ea8dd810bb09900bb7a40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149113, "uuid": "265654b2-6c1d-4f07-bc7c-10f9f7d1fef3", "value": "T15F941E38ADEA002A7173EF54AED43497E96FB773370E585D1081038A4723949EED963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149113, "uuid": "c9b7d7d4-acc9-4ee2-bf69-f660551b8e92", "value": "12288:mddmaY6Aje1+HHuXqxUwViYKarIxJavce1uhTQkqeu5xj7/E:AvJqMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149113, "uuid": "cbe0280e-2228-4659-97bd-e33ddcf00390", "value": 441250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149113, "uuid": "a67549fd-641c-4270-87cf-45cc73ca549d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149113, "uuid": "b44b49b3-6ad1-42d5-a3d4-c901e1ad7f57", "value": "PO 4590272645 - R02-Supply 00634.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8401145-3812-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776178847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178847, "uuid": "2caed3ae-4070-4c83-a1c8-9836cc9fc507", "comment": "Malware payload (Mirai)", "value": "855799c84ea135136375da6d258392b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178847, "uuid": "13af2799-36be-4f40-85c9-e7b265a7ef56", "comment": "Malware payload (Mirai)", "value": "4a3b082d323b6ea17e4a9f2f021874c402b65a84c92f852fa6c0ba7210eb2cd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178847, "uuid": "0dec3cf8-c23e-4291-8de7-55b63931ce81", "comment": "Malware payload (Mirai)", "value": "87839d2161ad6e756502f62b5de734aa0b3b3962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178847, "uuid": "0e0ccacc-a98b-4e9f-a069-1032c370c916", "comment": "Malware payload (Mirai)", "value": "f203fbae1a83170f73ceabeedd762e35ae2eafd60a634a3cc98b68b81de7a54394cb1a81549ea17aa79df858fef5f580", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178847, "uuid": "b8747086-f059-40b3-97c2-d33dea18b3ee", "value": "T1B263F1401AE66A34D711EC713D21DDE12AB9C63E81E277F020D7F2759BA124231FAD6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178847, "uuid": "3b70ccb7-70af-4878-a95c-111abe355ff9", "value": "1536:1la/GLSMfFBm8/1Zk/HXsi+Y+4kdsi+/fXoemv7z5Nq7HkyHAhHmwVzH:1lyGLSOFlS04ui/bmv7zab1uHmwVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178847, "uuid": "1338dd35-45e2-4264-b966-7746e23993b7", "value": 69796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178847, "uuid": "15527829-221f-4ef0-a30d-5b8f7811947f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178847, "uuid": "54f229a0-db50-4433-a889-fdcd10f10a48", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90082ea-3847-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776201692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201692, "uuid": "88c7c02b-eb66-4ae3-bfe6-9845429e8d70", "comment": "Malware payload", "value": "692da6e4bafd40213619a1712ddfd65f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dompablitoestu", "colour": "#407C7B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201692, "uuid": "a59c9aa8-81fc-45ce-b13b-5c6ccccddfc1", "comment": "Malware payload", "value": "4a899a3b0fd61937ce8555cb0da53daf72dadc7dd299c63e90b4a203e5a14db1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dompablitoestu", "colour": "#407C7B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201692, "uuid": "ccd8818d-9258-4e1d-90d2-59d9b3efd241", "comment": "Malware payload", "value": "085f31d9516a47f0678bfd42b047dbefed71268a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dompablitoestu", "colour": "#407C7B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201692, "uuid": "de1dff59-5eda-4d58-a2de-84192f1010dc", "comment": "Malware payload", "value": "15f08e3bf0100fd0a6492a7323360dea31e9e924ac8f6b11e277c260973f383f111987d5cfb00c2109db1711abcc156d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "dompablitoestu", "colour": "#407C7B", "exportable": true, "hide_tag": false }, { "name": "NFC", "colour": "#86B424", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201692, "uuid": "2fc8c2a5-b3a7-47b5-a240-bc19a62706b7", "value": "T1CBC5CE89FB58962FC8BA05330DEA923122578D478E879B437844375C78776E80F5AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201692, "uuid": "2b219fd5-5000-45d4-bed1-e94f6b1367ab", "value": "49152:Z+Y/TgIhQQBcWJoq9eE21OKmgZj2y3UPyxEX+yY1I6CS4jaEyYp:IgTpTJveEU2y3U6xEXs1IZfjnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776201692, "uuid": "92e8fb4d-e862-4992-9128-097d04d383f4", "value": 2577715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776201692, "uuid": "e9ee4932-a25f-4334-a6bb-dbf2af5cd086", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201692, "uuid": "52377aae-ebc5-4e65-94ed-30242a6681b9", "value": "4a899a3b0fd61937ce8555cb0da53daf72dadc7dd299c63e90b4a203e5a14db1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71787c66-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776164985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164985, "uuid": "5425abce-c865-4f9a-9b85-d61f1886773a", "comment": "Malware payload (Formbook)", "value": "752ed970a0e854eda14dc788092b0b5d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164985, "uuid": "5ff410dc-2ae0-4bff-81fa-91e65ba008dc", "comment": "Malware payload (Formbook)", "value": "4afe8337c12e3ceb9b3f676860bb2594a363b2ca98db1cee0a5e0a67349583ed", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164985, "uuid": "c2ec5dda-5bfe-4f0b-a22a-2b2af0da02e0", "comment": "Malware payload (Formbook)", "value": "4f7dc2dd4b46e3ca5ad3d07d1322248ff46e38b5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164985, "uuid": "afed7b8e-de55-416f-8f34-d6beb6f2c6dc", "comment": "Malware payload (Formbook)", "value": "7559dd96505f4f2e4662d9f6090ff38feecdc93a774b5c40ae5ff0ef855ac28a95dec9c030814b2f28c8280f2891b34a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164985, "uuid": "79049c96-0059-48f6-8a10-a0611ecc49e5", "value": "T156F2528B76CBB061520232A72F2BF11EB16F8C846A8C9455F9E5745CF83C71CB4769B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164985, "uuid": "ab80b5c4-4ef9-4db8-b844-40fdf4b47e26", "value": "768:PlSTU0d38+DayiQ3lpWgOJspuEmKcc3mgXmbm6tinwsNqOrTF6tAB91qRnhbPdkx:Pgh8+Da2LA/V/QpbyDbmRuRLK8qcX35w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164985, "uuid": "a6329b26-a38a-4e45-89af-e92034d2fd87", "value": 37286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164985, "uuid": "76ed9b6d-1e79-4fa9-b800-be2301affa66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164985, "uuid": "2d77363d-34d3-48d2-be02-e7dbfe827b07", "value": "BB MATE FATT.1-206.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcee1510-37f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1776167312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167312, "uuid": "c63497dd-320a-486a-b93b-227a4b141d1d", "comment": "Malware payload (Phorpiex)", "value": "85bfec102e0174e96e413f35bf29a1c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trik", "colour": "#F3CF52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167312, "uuid": "904e9360-34c7-420d-9c5b-4bac63b0214b", "comment": "Malware payload (Phorpiex)", "value": "4b0b22299315c31d97f823dce6da039fcc9c9d2dbcf141feb218f9939164a1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trik", "colour": "#F3CF52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167312, "uuid": "409c4cd8-f453-4f1d-82fc-137e2e94c780", "comment": "Malware payload (Phorpiex)", "value": "e2e11b25f5346c31df12413dce6fe48a901582e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trik", "colour": "#F3CF52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167312, "uuid": "55f68bca-1db7-4357-905c-c74d05b41238", "comment": "Malware payload (Phorpiex)", "value": "c66d971fb2c77eab3071599bb3439924e1adf9c8b2a4e28705026992c14441e70ec895b290f45f03584cc79fbb057fe6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false }, { "name": "Trik", "colour": "#F3CF52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167312, "uuid": "c3b24ee4-222c-4f81-8115-d60bc82663e7", "value": "T17A18339B07A48CAFE97B5E70EC07D751372A3C6ECAF481A11512BE49A1738276503F36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167312, "uuid": "2edbf114-ef6d-4340-968a-2625b635fef2", "value": "24f4223e271413c25abad52fd456a9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167312, "uuid": "2795fbb4-cc2f-42ae-8450-128823025a53", "value": "1572864:uLKXB8/kZsz/0e/Wmc5QMp7rSwm0PVANSe4ajGgzVWExQd+jrE8gnjpHkZE6b:GKXB8sZcFumGQmPSL0Pm026gzUMQEM16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776167312, "uuid": "9d1edb9a-bc5d-4778-a7ac-46a219497a6b", "value": 87304240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776167312, "uuid": "46bb4ee6-0745-4b57-855a-7d9075590723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167312, "uuid": "ee74076d-2bf9-45bb-b6f7-959ef1606976", "value": "youkuclient_setup_8.1.0.1280.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e34f61-3808-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776174572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174572, "uuid": "93264485-7cb9-4230-9f50-4f1600deb790", "comment": "Malware payload (ACRStealer)", "value": "d7ab5c5a5072ac557a1c00f6124cac66", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174572, "uuid": "d3498d39-5de4-486e-a37a-6526a2eb69e6", "comment": "Malware payload (ACRStealer)", "value": "4bbb57996c60677f102ac7af0c6bca1336224abdc0100273454243261dc9faa9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174572, "uuid": "8681661d-28df-4a05-bdc3-5f88e197403f", "comment": "Malware payload (ACRStealer)", "value": "8cd3df12bdad3aac24f37941ff856246ab937bb1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174572, "uuid": "d89f3e42-f0e5-4225-ba89-3f394c2b82be", "comment": "Malware payload (ACRStealer)", "value": "d9c084556a131d042685bed7a9ac0de151ddf70be31462d62fe4187f7ba967e20b7509c97801033b0165fc34936270e8", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174572, "uuid": "efe78f4e-cedf-4982-9411-dcfbaa57ae29", "value": "T139F633F4D666988DDC08F6F444FA5199CF9D1C80501783AE6EBCF2DB2BC65C3928CA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174572, "uuid": "13e3a585-cb1a-4120-ae54-abc854611778", "value": "393216:MtIvDsVrXET8asGxO4BU4yZNfaMJstwpbnLr8uzGiJp:MtIvo5UTRFUZZlaMJsylLfHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174572, "uuid": "dafa77db-cdf1-445a-9366-84b9223d846f", "value": 16381898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174572, "uuid": "6b0e3716-371b-49fe-bd80-794b6d7acc4c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174572, "uuid": "2aff840b-5382-4081-84f0-25974ee76a8c", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d4bc44-382a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776189101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189101, "uuid": "4896f538-6fa6-48c9-9f62-c51ba6346000", "comment": "Malware payload", "value": "73dd5d9a9293507164828f520540e586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189101, "uuid": "3ec69c8c-5b46-4fb3-9abf-01b7cf660efb", "comment": "Malware payload", "value": "4ddda625586db0b45743a86a2825b04ce3a1731f14eea500c52bb1110ae7a594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189101, "uuid": "2be30967-2ce8-41ad-911b-5ac14cd59fd0", "comment": "Malware payload", "value": "e64feaeef1cd8d25cb25433ab470c04a2ec2a5ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189101, "uuid": "d756cc49-d8d0-4dac-b977-29110cdd4c3f", "comment": "Malware payload", "value": "89169d28791ac5cdf8293d127450c9a69449f6d966577bd2f26b3cfd0c1b725e2797e0cd8e2b17eb3932a080562a97c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189101, "uuid": "d6a79239-9f6b-4178-afca-fe4c88f9a23a", "value": "T183E733807135C1EBDCC189F6B72696D6DB09BE8901DAB03D71DE3937B124A55A038B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189101, "uuid": "fd8dfce0-31a0-4aa2-9196-d2a94dbb6f3f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189101, "uuid": "9a75d2d8-3661-4672-997d-561f8f7227c4", "value": "1572864:OejOYfEN/5rC3qEzaT8rLXpHhxwLixMArSx:O4O5rC6EzaCLXpHhxwLix/rSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776189101, "uuid": "46fd3491-f9a0-494e-8a65-c4d7e04ab629", "value": 69324968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776189101, "uuid": "29f1c012-fcef-4077-9bf5-f3131207e126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189101, "uuid": "b2ee66b3-cd54-4f63-9eeb-a5bfa4f986ce", "value": "Webex.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f45c94-37d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776153238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153238, "uuid": "8f14db80-8a7e-4089-87a7-db16886ca494", "comment": "Malware payload", "value": "791b233734d0145a4b074a7e90bf7173", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153238, "uuid": "f3728e9a-f1d0-48f0-ac19-6e97ab7c3e62", "comment": "Malware payload", "value": "4de866be72f792368ac9a1eb6a271a0edd8cccbc35ad6b9efd8ad7b690560184", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153238, "uuid": "aedbfd31-1176-45a0-8b04-1652b2f712ce", "comment": "Malware payload", "value": "ccc1d5b56b0babf0436a0e209f64e24cf01312e5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153238, "uuid": "f3712b1c-1649-4eaf-9c5c-e8a8e30ed80d", "comment": "Malware payload", "value": "8107cd0258a2497c791c1f3f253c83e59a2c4d0593302ab25d2cdbcdf15cce583bbc0a27a783034e14ab128ea6cd857a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153238, "uuid": "f2d3893d-c2a9-416d-85b5-680719972c17", "value": "T186331D2959E06091626AD14638F9C940860CB1325EFEF8F9CBB9C4DF2D4DC58BACD9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153238, "uuid": "916810ea-14be-4c2e-949c-e2f51efaebf1", "value": "768:W+/lgWX2GV2T248JzsYnfpCkYZkwfRRruq5cDrFa:W+/iE2GVmR89dBCkYqwfRJuqida", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776153238, "uuid": "8610e452-da50-4e08-b248-f45532c34ef2", "value": 54643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776153238, "uuid": "32d07fd6-e122-49c7-a5b0-3da09c2b52ed", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153238, "uuid": "1f80845f-052c-43b8-b7fe-d2497c9c91e0", "value": "service.global-e.com_orders_2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9447b9fa-3847-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776201550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201550, "uuid": "67c6f76c-ee5f-4d4f-bbdf-8280f542c84d", "comment": "Malware payload (RustyStealer)", "value": "cf100c69d1de551da6707dac64a0dd93", "object_relation": "md5", "Tag": [ { "name": "77-91-97-172", "colour": "#62739E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201550, "uuid": "ab774264-e553-4054-9ece-723169ab18c2", "comment": "Malware payload (RustyStealer)", "value": "4e14ef27a32eaca0ca88fe17e65ad0a88a0fd47d2ba7aef196b3f2c4b48aa06e", "object_relation": "sha256", "Tag": [ { "name": "77-91-97-172", "colour": "#62739E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201550, "uuid": "39cc2e0f-eceb-464f-86e1-eed314fe0679", "comment": "Malware payload (RustyStealer)", "value": "ad7dea9b32a2dc19c1b3f6ae8d2cec62199ca321", "object_relation": "sha1", "Tag": [ { "name": "77-91-97-172", "colour": "#62739E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776201550, "uuid": "68281d70-00c6-48ce-bdaf-e17d6b4e2562", "comment": "Malware payload (RustyStealer)", "value": "c68cc3d36bd5bd6a7c88cbfc4ee1586162b2b7361d31234522d2ab90ceb72e4fa00531f305e8b24a19af34f7a8998b50", "object_relation": "sha3-384", "Tag": [ { "name": "77-91-97-172", "colour": "#62739E", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Stealc", "colour": "#908D12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201550, "uuid": "bbabcbd6-1f00-4154-af4b-e7b985232ccb", "value": "T190364B21BA5A95ADC15AC474C3478A729A7174CF0B31B9FF40C492783F6AAF42E3C359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201550, "uuid": "e09cb500-84a5-48ee-9230-3d207082233e", "value": "9d437bc71e95142f3bc4991d118f776f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201550, "uuid": "1930bce5-ceff-425d-b7d0-ac4151d9dc62", "value": "49152:TfoAON6pZNmsxZ77pqFYZqiNx/3r9FGdkDyb26KrYF+9jFOOuAObDFlqilZG09cw:Dn78efDNxJrNg7XG09T+0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776201550, "uuid": "d2876e08-9df4-4dde-805a-62ed3bf77328", "value": 5261312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776201550, "uuid": "788775d3-3f14-4fa7-8c38-a371e1ea0534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776201550, "uuid": "99dab1f1-1a11-46be-8585-ef0859da7608", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e0ebcd-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776147919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147919, "uuid": "dffe90f6-63c9-4ae8-8b0e-90be32b900ed", "comment": "Malware payload (PhantomStealer)", "value": "744db728d997488b6fb543ced432cfc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147919, "uuid": "bcf4fd8b-0d59-4164-bbf5-d395878c7c19", "comment": "Malware payload (PhantomStealer)", "value": "4f91cad862caf2655e0a63e2b22c21805769b1c5e38ce9bf1d6b8ac7653d157e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147919, "uuid": "3db09b6a-2e5c-48d7-b3d0-e010ddf6702c", "comment": "Malware payload (PhantomStealer)", "value": "a24f11570720c757c49ec579309a43bff654b98d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147919, "uuid": "38cc6220-3297-4b92-8ff2-dc758a656ef0", "comment": "Malware payload (PhantomStealer)", "value": "30c7151bd38aeeb661c7721c597953bc7ade6a6edc9712097e8d5d2290e6f4c08e7fb3c27cf2884c173c1ad4f67c1f54", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147919, "uuid": "86120476-cb0f-46f5-be51-63bfb25cb2b8", "value": "T1FE342CDB54EF624E4F98BF7DDAB0C2D34CEECB040845B4E3B7249607D214B6AA249716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147919, "uuid": "c2043686-0863-48e4-b593-2e3ff4fc94e2", "value": "192:WoYshJ6SVE97lBzAsoh/j0KehJ6SVE97lBKbUm+GjipWpYp6IbS5tchh6p+AEGZF:WoYfqioWsw6oWNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147919, "uuid": "77d3631d-a093-4c21-a387-5cf5ffa2526c", "value": 232661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147919, "uuid": "fb475cf7-6a4e-4c86-a794-0b04749489cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147919, "uuid": "50f19aca-40b0-4fbe-a50f-52d1d0bbb702", "value": "CamScanner_0412202618scannedcopymoccPdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e12366-3808-11f1-a769-42010a9c0008", "comment": "Malware payload (CNBackdoor)", "timestamp": 1776174352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174352, "uuid": "f138f7f1-ef7f-41bb-80e7-713d97b321e1", "comment": "Malware payload (CNBackdoor)", "value": "edada46a6b7bd4de2cca55abbb04844b", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174352, "uuid": "7778d925-abfe-4dd8-aede-3d7c0fe58f65", "comment": "Malware payload (CNBackdoor)", "value": "4fa631a1f53f2a220595072e1d6bc5c963a70be5ff9fd7cf2c47245e6f7d715b", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174352, "uuid": "01ff1960-37fe-40d1-abff-85552701b448", "comment": "Malware payload (CNBackdoor)", "value": "55ec0a175c74081d8afbc35277e18fde0a6a6182", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174352, "uuid": "99972672-2750-4a3f-b584-214e5540bac1", "comment": "Malware payload (CNBackdoor)", "value": "ed91930a6cc498d34cd24b8598a35d3157c6dcac858c96a00005fd24c1a6298166602a1e0e83cf29935bcda6222a3d39", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "tommysbakescodes-cv", "colour": "#603258", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174352, "uuid": "82a559b7-9e48-4212-9157-dc45efe09889", "value": "T11EF63330E6190C7CD54E6576989AF0273E5AACA200DD31E5336E3EA35FFCCA6C588917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174352, "uuid": "88756712-4e6a-47fe-bc89-efdded1ba476", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174352, "uuid": "e9e0e5ed-8321-4d8c-af38-21948c082f12", "value": "393216:xNTVfxopTLCVyd/OYWan+Vpre09oQQIGJqumhycjk5dhHK1zbTn:xtVfx2TLCVyd/OZpi02QvHjwnhq13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174352, "uuid": "ac9b57d2-c239-4dc0-9f00-57033329d519", "value": 15376384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174352, "uuid": "d5fdb155-4209-49ca-985e-609a8f4e8b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174352, "uuid": "a24c071b-cd87-4524-a5f2-42a9d1e093fd", "value": "Installer_v2169_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bca3ccf-3845-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776200462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200462, "uuid": "e54d54b2-8cd5-45c4-9de3-7310342bbb64", "comment": "Malware payload", "value": "9c6f9a3324dbfedbc6939f5264ccbde6", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200462, "uuid": "ede6d6fd-16e4-49ce-96e0-b1ed7cf4a032", "comment": "Malware payload", "value": "50352a0826ca63b0843be3cb37d6ae0963f8fa6df7988ed195827431e282e1d9", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200462, "uuid": "acfe3e38-8d01-43ad-bf5f-7e56a4f9193c", "comment": "Malware payload", "value": "76d193749589f043a2f0a91c623d34c88a8c244b", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200462, "uuid": "58774317-9ca1-4249-a4ee-c9937de503cf", "comment": "Malware payload", "value": "f717ad49f0e5eb45ee8c9345429abf2f400a94638febee9f37e4e2b1190ef0b1218116bd1c15e2e7404efa47f773cde4", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200462, "uuid": "8b06a4e4-148a-471a-b935-e1ddb4660ae3", "value": "T1A86723E8EEDECED8AD9DF8707DEF03D05C5499CAF223884552DAD5B8E203A0B06415D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200462, "uuid": "15e8036a-21c3-475d-a716-8ec2e48c6765", "value": "786432:5dXBq7ygqOB67FcQwETg6NeLezyepHNFgJL2XdtdDuJ:5dRq7ylOBgrTTYmHn0LAtdDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776200462, "uuid": "6df14b1e-8125-4ed4-9424-139d1d43e3d5", "value": 31482171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776200462, "uuid": "94a7d962-be16-471d-a06b-844edbe2fe97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200462, "uuid": "2831416a-3eb0-4e3c-90b7-3e4900550ffc", "value": "RivalMods.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d6da62-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776190997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190997, "uuid": "cca1a0f1-d66f-4fa9-a75a-3819437b88c4", "comment": "Malware payload (SnappyClient)", "value": "5a381eff5878fe0c61df4177cd956f2f", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190997, "uuid": "cffa490b-bf3e-49c6-9737-5a9750a40a89", "comment": "Malware payload (SnappyClient)", "value": "52135498a9e8311954b9c3f41302ec7e62aa37ea03efc91267852a73e8239075", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190997, "uuid": "cbd17f12-bc4a-4ee0-88dd-30207cfddc46", "comment": "Malware payload (SnappyClient)", "value": "6d832c3171680b7d13c915f002b0fe6bb4d7ef5a", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190997, "uuid": "b82c42a1-0a4f-4e0c-bfa9-00a3db8a850c", "comment": "Malware payload (SnappyClient)", "value": "2f803de4b1f774eb6ee3d49e7ec70a470ed48364c08b7060dc686c559b1b0b95fa57ee0e7a13c1dccda6a10cc604e5cd", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190997, "uuid": "7eb4d24a-9e29-4b06-b7be-0f5a37f3cfd4", "value": "T18965336142D0003DEADFE4BC9AFB25794A649834FB4CA4DF49D015D2A9EE0F35134EAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190997, "uuid": "24b99a2e-553c-4974-8bc5-3f77bc44712e", "value": "24576:kYwZWHriKym2/6qVK47ELji1FHbfD0XRV9nNv5kWoAuQOaeHozDYC8h8ILF:JR966q1SwJbIX7BNqQQImCI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190997, "uuid": "e6301bed-18f1-4c6a-a432-27ed69f4ec66", "value": 1412096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190997, "uuid": "40dd0de4-b3a2-418b-89b8-542a047682f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190997, "uuid": "5916b4d7-6444-49cb-8c9a-d1b2d2fb65d4", "value": "52135498a9e8311954b9c3f41302ec7e62aa37ea03efc91267852a73e8239075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26878e7b-3844-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776200078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200078, "uuid": "f7c6d030-a542-45db-b01c-eafefa127e37", "comment": "Malware payload", "value": "5a1c8e1f47fda95c5ac9a7c7052400a7", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200078, "uuid": "56fc8cb6-595a-4819-a386-6b0417415e10", "comment": "Malware payload", "value": "524f4410012eaf96e6a64aaf4d5b014fa156f4ea31a5b1a6d6c99952d0eb63f8", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200078, "uuid": "dc4ee20c-a828-4e6e-81d1-e1a5a01ef56c", "comment": "Malware payload", "value": "cf84112990a07dc0ecfaf03e7c16c86ccee06b43", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776200078, "uuid": "ec4f1523-078a-4436-b100-fabbe13b3d5b", "comment": "Malware payload", "value": "11a89e26e7ed1eae50dda9a102bbc3862b49c486dc9015fc76990b35f7db1a6f8a7b60c955b0adaaae11b350c5052a98", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "j6fadacai-com", "colour": "#F74AE0", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false }, { "name": "xiaoshihou37-top", "colour": "#4E0490", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200078, "uuid": "cfc099e3-132e-405a-8512-057a894a0ff0", "value": "T1F006C0553D8800B6C4530231AAADF678E6EEFF7C172541DB2259763E6E326C14A3E42F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200078, "uuid": "64772da9-9a0f-4798-bb41-91dc9e468910", "value": "055aa6265fc08e5361531fd56151faf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200078, "uuid": "c3fb1b5d-9b5f-48bc-858e-47839cf0a208", "value": "98304:jLKsW/ZjvrGql+q01C+MQfezH5y3vfFLOAkGkzdnEVomFHKnP3:jLKX/ZLFUezH5yHFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776200078, "uuid": "0b39a4e8-d88e-48bd-b531-9a5a439e3422", "value": 4000256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776200078, "uuid": "fc055d68-0c2f-44dc-b64a-7c4c830cd456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776200078, "uuid": "50a62279-9485-4275-8777-ace205ad6b05", "value": "datesksupe37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15524a8b-3852-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776206062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206062, "uuid": "b70f176c-606f-452d-8475-e2d8442d8423", "comment": "Malware payload", "value": "c9919741c896cd1df8964e59b9350063", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206062, "uuid": "d5ff7d95-f575-44a1-a2ea-696471662e72", "comment": "Malware payload", "value": "529a608db061a2865262033e8d152955cf643463ec2937040327eb7b85d7d539", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206062, "uuid": "ef8896f8-650c-4dfd-93d4-312cb8ed9349", "comment": "Malware payload", "value": "cdfa537e19d64539cd70483c9d4a818e459bb13f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776206062, "uuid": "88096a3e-31ab-4f09-9385-1d0a70e40a49", "comment": "Malware payload", "value": "382037489debcd68e265d204480fea8fc7252252191d980c11c8ee79030e2cbf063c8f9a1fd2f7064a76a9e028fa8f78", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206062, "uuid": "757e67f9-0672-4204-8654-947b8c26997c", "value": "T177137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C09ADCD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206062, "uuid": "6b4fba61-3b5c-445d-af8a-8da4b0794537", "value": "768:bY+d9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bY++cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776206062, "uuid": "65b32c3c-cc33-40c6-ada8-79859a8bcbc7", "value": 45543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776206062, "uuid": "fe34959a-3412-4025-a285-e24823f65a4f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776206062, "uuid": "654705bd-c6e7-443f-a43e-e0080b0956ae", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bfcc60-382a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776189117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189117, "uuid": "fe93883b-9dd1-4c71-82c0-3de944a38d5d", "comment": "Malware payload (ConnectWise)", "value": "07568c6939e790aeab9ea7e0d05968a8", "object_relation": "md5", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189117, "uuid": "0c643a4e-83ba-4bfc-9ea8-dba1117d2f5d", "comment": "Malware payload (ConnectWise)", "value": "53ded9999508b3000ffaf1af6c6bc46f74bb6afe30b91027cbb8a14f65793fdb", "object_relation": "sha256", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189117, "uuid": "1c94e34b-0f71-4ebb-873a-abab87efd07a", "comment": "Malware payload (ConnectWise)", "value": "63ce20859a3f388f3320248b901aa2c0d892ad1f", "object_relation": "sha1", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189117, "uuid": "94225eef-ccb7-4de1-bf39-4a6d39d4a641", "comment": "Malware payload (ConnectWise)", "value": "7c5232e5c5593ab8f9ec3b5f7398bcc1ef3af2322c5b7c77ac5a7281e454e9a896d257ecf3f9707343857b4f45d4d9af", "object_relation": "sha3-384", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189117, "uuid": "16c64276-759f-491e-af0d-61bd71d7465b", "value": "T103D623226BFD0918E1F36778FD3A91E291367C659F12C08F2614785E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189117, "uuid": "634d5821-b2ec-4aa1-bc37-7390a1c7292c", "value": "196608:RrnLYG3zDhukOmrnLYG3zJrnLYG3z1rnLYG3zernLYG3zirnLYG3zhrnLYG3zD:RbDDDgvmbDDJbDD1bDDebDDibDDhbDDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776189117, "uuid": "cfe815c3-ece3-4b35-90a8-ef95f966442b", "value": 13766656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776189117, "uuid": "f7d399be-08ee-48c1-bbbb-8efd3eb23544", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189117, "uuid": "624ebce8-f913-48a0-94b8-00f2e81f1119", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e140d377-37df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157012, "uuid": "d47f8930-5f67-4484-914c-1795e078e312", "comment": "Malware payload", "value": "6c02bf6ab04ff0d95fba5023f2dd9da7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157012, "uuid": "1fe9a526-1687-473d-9bd0-9d7bee4b2921", "comment": "Malware payload", "value": "53eaa4da8718a258d2fd5364b3fb76fe19af1c3292da0d6509bd8c64b5a21fa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157012, "uuid": "6dbf5eb6-c4af-445b-bd77-73c63d93e5d2", "comment": "Malware payload", "value": "4052761aeeb5c176bf941d3333d2793a83ac59d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157012, "uuid": "475cd156-26d1-46f4-a572-b6f1c40d2a18", "comment": "Malware payload", "value": "add2ec84b4f09ca9331a95d5e03ac59fc2835ed596a80be51729c11adf530529fa95aca3488bec613d053ac808355ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157012, "uuid": "4fc73065-1e3a-4c06-925e-4ba8f04f6ed0", "value": "T138A3595772A500ABE037827988631A09E772B82157709FEF076842956F377D2AD3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157012, "uuid": "aed492e3-6da4-4203-a030-d81dd19c9c2d", "value": "18e2690202e0eec0807b55895fa64537", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157012, "uuid": "9b011077-1570-4e30-a8fb-ae2fc538163c", "value": "3072:J3Unb3wwscFHpvWps1IsXNz2Nsw26BenZj:63bs6H9asHFnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157012, "uuid": "06500439-0994-4895-85d7-9e57ebb6fc2a", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157012, "uuid": "721a8243-f329-4173-88e4-1d57c251783d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157012, "uuid": "cd21f9ff-1592-4c81-a587-8fbdd420394f", "value": "Rdll.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b23f3d-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144582, "uuid": "96556e02-635c-44e6-94a1-40240f083396", "comment": "Malware payload (Mirai)", "value": "cccefbea130e0be0512c943986d0bb55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144582, "uuid": "27cdc013-fc02-483a-8806-56df98d2ca73", "comment": "Malware payload (Mirai)", "value": "5419f319fa97c2de00b9639b28de5140ceb796bc424ab34140427c6ec2683fb2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144582, "uuid": "e166cb58-2a39-43fd-bd3e-0e0cc93d35f3", "comment": "Malware payload (Mirai)", "value": "16b55b602bd726b91e5fd025c05e72da6233b561", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144582, "uuid": "a3477d6f-53b7-49d5-bbaa-be31d0c202e7", "comment": "Malware payload (Mirai)", "value": "dc00311bc47f193c1c343422de0d573bb98fce7eaa260ad721265251204948ba0c48255dd853a0e6c9d6f5ab8f08d1ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144582, "uuid": "0bc67e00-bf77-4da5-8997-f254ffda00a9", "value": "T1BBE34C56EB418B13C0D62779BAAF424533239B64D3DB33069928BFB43F8679E0E27505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144582, "uuid": "9afaa853-b6c9-412b-86cd-c67c1cf7ebfc", "value": "3072:ISSOZvj9ZbZQ3G1a17rC1cUwXyXMKfmtZv+kGM/9f2EO6Y:ISSOZvj9ZmOa17rC1c5X2cZv+BM/9eL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144582, "uuid": "63081e7f-62a2-42c5-8b26-a408cf8baa8a", "value": 157206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144582, "uuid": "60a95e01-c9ac-4031-bc15-3b8e66bdffbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144582, "uuid": "01161687-0bb8-4e36-a7ec-962b315789cc", "value": "kkk.arm7k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32050d93-37e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776159295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159295, "uuid": "8a4b8526-cef3-4dd7-8f58-15bada5d5604", "comment": "Malware payload (Smoke Loader)", "value": "972560f13b51bfd638ff97a770711a04", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159295, "uuid": "f804ce73-14db-4c3c-ac11-fa0fc444bcf9", "comment": "Malware payload (Smoke Loader)", "value": "54731e0a4e0abdfa8b535103880e8db2c1e85643c5b8ed59d7f1c724382afd0a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159295, "uuid": "da4a3ba4-b8b7-45c1-8670-669de7ac1156", "comment": "Malware payload (Smoke Loader)", "value": "95aa946e5b19aba557bef6b8139a004f02c41116", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159295, "uuid": "34025ecf-6ca9-48ca-bb7c-edbb35adeef4", "comment": "Malware payload (Smoke Loader)", "value": "fe234fe2c8f81017a97cc843dd50461694c82fa6e61c795ab187c9e2a56469ff43e4bed1e3aeaa18787d4735e055696e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159295, "uuid": "f636a1f7-1737-440a-bf10-09a4d36ca3f6", "value": "T130A55B4B6C9509FAC46997318CB652957B70BC480B3233D72E91BA783F727E06E38754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159295, "uuid": "06879503-938e-4765-bda1-49d9af99ad99", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159295, "uuid": "c36230cc-86e2-479d-adf5-05797cc061fc", "value": "24576:JiyP6Mn7YdC9X1xRDuWZ8wYAg7sEP+yKn6PWecumZPJheleh2Km9qCPR:JiyN7YdC1xRlZ8zA8Gy4dnuDX3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776159295, "uuid": "dedb2669-d99a-4ee1-80e6-b8063e9cc544", "value": 2231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776159295, "uuid": "2fc7eae9-3a88-41e0-b02b-269a2f8bcc98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159295, "uuid": "7c16fe87-975a-4753-a68d-8713d31da5db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc7e1b5-383f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776197892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197892, "uuid": "c9978dff-9aa4-40f0-9049-baafda4dc26d", "comment": "Malware payload", "value": "0b4b51dbd9ec468a7c91bd33342a1314", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197892, "uuid": "70f7732d-1541-41d1-b270-18f0d2bad2af", "comment": "Malware payload", "value": "549e4a4e88bc3d885ad4b01cee6dfe387726cb46fe338d3a6c2b138fea707ecf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197892, "uuid": "8f0e58a7-2c03-427c-a37a-be775dae6eb0", "comment": "Malware payload", "value": "c88f7ef4ac45ffc5e3297bb5822f9dd23c651f04", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776197892, "uuid": "8ea80cd9-b08d-49e7-93f7-eaaeb08afe96", "comment": "Malware payload", "value": "4409d4e8f14fd96d413db25459b035096628df2ade77e00bc5b3c84eb34880d6296c980c1e04efb8eacc5cd3ef7cf4a7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197892, "uuid": "7d8d3f8e-524a-4aba-a9ff-b1e07abd24c1", "value": "T1E6F6129279C562F8D0D787307A87229A70D0755AC6F9C94B26C71C033921EEB9A4B7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197892, "uuid": "736dc678-c38b-4d07-982d-7651af393fae", "value": "5b99a1349da58ee79499979c3e2113eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197892, "uuid": "686ae560-d58e-411c-b9fa-c0315f925fbb", "value": "196608:bCD+8XOFdKVQRHQHrDdPhuo4BzJXtXoP0GlHa7LIrgXyore8lYIUkW5dFB0Ji:hC4QrDh4UPJlHwLryorHxINBAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776197892, "uuid": "c83112e8-dc5a-4091-b041-828dfee35f30", "value": 15618560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776197892, "uuid": "8c19eef4-1e41-48c4-a419-4f361039c497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776197892, "uuid": "36d56f2c-f7d7-43ce-b716-24fa9b38b474", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158cb3d4-37ee-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776163112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163112, "uuid": "9f25a7b8-63b9-4269-8c6a-27df514287e7", "comment": "Malware payload (NetSupport)", "value": "d18bcd5853a2d2af102547747a8e795d", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163112, "uuid": "a1268eee-7a89-4a86-9e1f-290d67b33976", "comment": "Malware payload (NetSupport)", "value": "5501b12504595939f6492dfcd23656d29a294673ff5bbb5dd0c62314f431a2d5", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163112, "uuid": "dea7f803-8f8f-48c5-b2f8-bffc8340e2a6", "comment": "Malware payload (NetSupport)", "value": "e4c8a28f37db5171d61c7428721a92e9dbc2a349", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163112, "uuid": "1be5913f-e90b-4f2b-81ca-a749dd0c11c6", "comment": "Malware payload (NetSupport)", "value": "327d8186d987eb9b416eb0f4a05814baa080a4f609f364f1c1b939ab77b7a29324c987d45c180a0c88018f01cdfe5a5c", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163112, "uuid": "e6646066-08d2-4522-9dbf-53b0c91ec337", "value": "T1CA82CF18FF6A08A8CBDBA2721E524BAEE90DC3D5518FC5EA41740CEAC5D7F480F44B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163112, "uuid": "d6b62067-f166-4b3f-a022-976c87e29875", "value": "384:72ObHNKHCRDmsG8FeE2DD8yEP98N+YD7cks2jDiWjPhmvzYqPfVL796Ul/2:6qHyCRSsRPSfQRm0n579x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163112, "uuid": "2bca6611-f586-4e33-b879-bff434a04d0e", "value": 19129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163112, "uuid": "5a830289-e9fe-4216-b6ac-c78b7bb23b99", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163112, "uuid": "6b94200f-ed25-493e-a7d8-ceb899c67e9c", "value": "BuxgalterTekshiruvDasturi.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdc86b0-3828-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776188143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188143, "uuid": "62cb9518-7281-4b29-b48e-01c80d359a11", "comment": "Malware payload (Mirai)", "value": "c8bb7c354de752b86bb82dbcb6ffd482", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188143, "uuid": "0ad9a96b-f222-4d92-818e-c6f54cceb39c", "comment": "Malware payload (Mirai)", "value": "5598c38cb4f620c43bd4921b590346b91f61c7c6e131aa4da25c89e6de887b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188143, "uuid": "c127086e-c4c9-42b0-874d-a14ed983f9c0", "comment": "Malware payload (Mirai)", "value": "3eea6cc9b16256bd86616b47bb32917a571528f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188143, "uuid": "c2948b79-4008-4e31-9e72-2752006b8ab1", "comment": "Malware payload (Mirai)", "value": "d96e51c5cdf6867bf4a816db0bc2194a44adce7b18954f6298d2e6322a93212a14265c3e0b4d6a68ff51e2422a65c2c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188143, "uuid": "7a533e31-eecd-4f0e-8f0f-fea34d9d289a", "value": "T1507302A0FB71AC7AFD6388B4FA665A026C24FD38D7D5D0E9316C914934C1841CBF875A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188143, "uuid": "9997cbde-c1a6-4e9d-8021-2b5b7759bf69", "value": "1536:3sqQqIqP4nZYDk6+0M++QhR+/F5Rot3GnBLM:DQN10B+QhR+d5RoBGnBLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776188143, "uuid": "43196a76-efa0-40ba-b966-2a6199fdcfcd", "value": 74348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776188143, "uuid": "c3cbb3ba-867c-492f-9d77-2efb49c443ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188143, "uuid": "66723c27-4dfd-4856-a345-de798fb0374a", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e10e6cc-385b-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776209969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209969, "uuid": "bbd992c1-1ceb-4ad6-bfe6-97a8ba1765e6", "comment": "Malware payload (SantaStealer)", "value": "9e875377e349fd351a221764e0647036", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209969, "uuid": "dd016630-b7b7-4d81-9662-e518ddd27180", "comment": "Malware payload (SantaStealer)", "value": "5708287c0e76677cda064e7221cba018ef2c17e4c5556ccbf829cdfa56621bb9", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209969, "uuid": "5ab3af4c-2815-4ef9-aee7-1a0d0b7cce07", "comment": "Malware payload (SantaStealer)", "value": "e14953240f2b8f471ee2d79d31f535bfaae85183", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209969, "uuid": "372a4fd8-2859-4dc0-b9b1-a4eab5e60885", "comment": "Malware payload (SantaStealer)", "value": "cd1b8cec191caf389631cfefffd9c2aea301ba6f6bb2f4adfa61e07e9e3054b90c552eef832cfa3cf63ce4918886f45e", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209969, "uuid": "6f451cbf-8186-44b2-b880-6037a3718258", "value": "T1C0269C27E3A360ECC53BD0749747E672B931B8490434BE6A0A84C7613F66E605B7EB74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209969, "uuid": "b86fd513-610f-49b9-82c7-bbe4a4233e1d", "value": "ed6edba9ec77ed904b0920d79686675c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209969, "uuid": "54658bb0-c879-4cdd-82b4-4d350d649ee6", "value": "98304:HJ69mv0newp3EX0wEvj9Hg3bPvW/ZYXuFNxMUB:HUc+waJHg37AZKMN9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776209969, "uuid": "672f2109-ef80-4fbc-902c-6292ae0c1cfb", "value": 4511232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776209969, "uuid": "a4c75cdf-d3da-42ff-ac17-d7441466a316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209969, "uuid": "472462c0-0511-4551-81a8-644678a0d438", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8767495-37ef-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776163869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163869, "uuid": "173656c5-92f4-46e4-8b16-4e8f99be1292", "comment": "Malware payload (ValleyRAT)", "value": "d935c37b954c61c1126b19c7ca5569d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163869, "uuid": "28eb3f45-c850-485b-9149-f60370082164", "comment": "Malware payload (ValleyRAT)", "value": "57538a8b1bb306925d3549bce1ba5b09e1383c2dfd2efef38f15a93d5583d362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163869, "uuid": "81576a97-1fd7-495e-807f-81329702927e", "comment": "Malware payload (ValleyRAT)", "value": "c945a54065f0cc1279c4e219fc2c1cbc6c6205f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163869, "uuid": "1f5b282b-bf85-4c27-9181-21c60a978c25", "comment": "Malware payload (ValleyRAT)", "value": "64e495b90c99f8177b64ea688f0a1c1c160b69191dd50ad24e2b03f09024ba4fdba88e1103e02e2ceb8795ab537077f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163869, "uuid": "dd784161-e94e-4bc0-8669-a53ff83c9a21", "value": "T1D8B58D21368040B2C46312339EDEF2F9A3BDAA34CF3945C7D794BADDB9A25C3452456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163869, "uuid": "20d60390-b6de-4b8d-a929-f393165b1a9b", "value": "290b83c70a18f5748e8dc8bec5f2985d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163869, "uuid": "f17f60d0-7fcd-4317-ae97-508c7a782ca1", "value": "49152:g2u2P04oVRsFTF9LdoDMKUWmh2o/umt89j4DNXUtjH:gx0SVRsF59LdoDMKxRo/umtGj4DNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163869, "uuid": "75be0e56-15d6-4dd3-9b10-a72c4922d10e", "value": 2280960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163869, "uuid": "41bfd496-4301-4eeb-bf81-07b90518f921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163869, "uuid": "7dc63ec5-1555-4f6a-8f31-345a2b597bcb", "value": "57538a8b1bb306925d3549bce1ba5b09e1383c2dfd2ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a0f103-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127224, "uuid": "882e8116-37f7-4ae7-a283-a37af5f90215", "comment": "Malware payload (Mirai)", "value": "822e3836650911bef45bc15bb96ce8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127224, "uuid": "c9929f04-292b-487d-9ce9-7cbad31b24f9", "comment": "Malware payload (Mirai)", "value": "57d634c5b4af44ef175b07327b2d3a35343245132213e23ce30cfa9399766976", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127224, "uuid": "b61a2ad0-3d86-4fe5-86ba-dba5f95ae71a", "comment": "Malware payload (Mirai)", "value": "f7ace1df11c1ff7d0b0b9c78b085f372fea433b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127224, "uuid": "7e67526d-b61b-475f-b07e-15bf2d4b7c15", "comment": "Malware payload (Mirai)", "value": "7039b0202b4371172afcf175ea9c5a1965f837d204badbbe0b3328716ecef12f5f792e8a313ccf8bb2134b97cc36eef3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127224, "uuid": "283fd2cc-4168-40be-a564-c9d0f446e7fd", "value": "T143A30846BD428B03C6D225F6FB5F064C3B1657B9D6EB3242ED25AFA0274B4970E3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127224, "uuid": "193f9e23-3e2c-4279-80dc-0b6c20b6bb2c", "value": "1536:nZU4J8cg8BkA7jFn88gkolp104AUwEFBeoRwMtYEGZ1rxX29XABifb23HbE95zR/:n+0F6qD1hDXbE9pdcj97pvekIO+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127224, "uuid": "8b0bd605-4802-4b14-bd20-1a9df67c90c2", "value": 98872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127224, "uuid": "496cecdb-9445-4f4d-970c-1079c1ed0089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127224, "uuid": "d265f657-87c0-4e72-86f1-6484729da28e", "value": "zyre.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c837075d-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776152675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152675, "uuid": "8c2c23bd-67bd-4d07-82cd-fd0a28353241", "comment": "Malware payload (njrat)", "value": "c9469a994e10e0e726449706a55ffc31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152675, "uuid": "834d137c-1d56-4ef0-9584-e3e35be0e825", "comment": "Malware payload (njrat)", "value": "58482050ff75fc1fd60a2b6e23180dbf5ea12a40fb69eb1cdfd3f19d6e8a0a33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152675, "uuid": "614e189d-8f5c-4222-a112-f125604e74f0", "comment": "Malware payload (njrat)", "value": "961a983b96c424f60c6bede8803dbcfb8f5f5333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152675, "uuid": "4b9bc8ed-97bb-4c0f-b5ce-713f92cff825", "comment": "Malware payload (njrat)", "value": "35897d4a1c6d8cd600a61edfa19bd69d7f591386c7eda92af01ccd63dbac9a2ab1909e424c799030353154b8e72e0ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152675, "uuid": "2f021d55-b619-4ca2-b54b-37df416dc230", "value": "T1E725C09173F4850BE1FF1B75A4B249494BB7F9529936DB4F0988A0AD1EB3780CE103A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152675, "uuid": "b95e5780-c1f4-4d0e-9d98-fb8c916274ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152675, "uuid": "ff36d59c-125c-45f8-89c4-b21d9c5cd026", "value": "24576:aF/pcJxJzck+uGW/yFoBkkAQVuqhz1TWRgiU49Y:aF/p4TYjqqanT5T2U49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152675, "uuid": "14e37594-9952-4464-a80a-a73fdc5e4d89", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152675, "uuid": "76da16b4-a32b-42a5-8733-fd89429dcf62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152675, "uuid": "cc97a7d9-ee44-4755-85ec-54d0e0baa120", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341ec137-3827-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776187645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187645, "uuid": "43bfe107-4697-40c3-ad9a-d206cc3d939c", "comment": "Malware payload (Mirai)", "value": "48393f6c4b41f15ffd74bd055aa0da28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187645, "uuid": "a9d151fe-1229-48fe-b046-040de82bd296", "comment": "Malware payload (Mirai)", "value": "588af2990d2321bfdf41da9329e48fc6ca7bebc21a4f93c1cf8a45d74c609d0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187645, "uuid": "359054d7-6cda-4e43-a99e-74ad501589f7", "comment": "Malware payload (Mirai)", "value": "2753eb1a83d959edd761f027bf20328507b281ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187645, "uuid": "6e48ebf5-39ff-467f-b72e-773c71aab839", "comment": "Malware payload (Mirai)", "value": "1c576936458a1ba72b44cc2b149085724585fed04cc941190661320b26caa03c9d5fbdbeea8d4efdaa6e16fee1558eb5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187645, "uuid": "e204eda6-9874-4000-81e2-0af9fca75893", "value": "T1597302AA93E614C3C9BAF03FC1CF677467467A25A7A767CA6334CC945F72D02B509088", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187645, "uuid": "5e96b737-8b89-4788-8d20-53c451d50bd8", "value": "1536:k9uGyHh6wPSF8wibbABD4YghqsnogDeGFsyP/IDbvfASn4obfk6YOoxS8Q:7GwQwP/HbbABEYqxJJ/0D4qM6YNxSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187645, "uuid": "fe0ed318-2219-4961-a83a-7a70ed642eb0", "value": 78568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187645, "uuid": "e2f3e4f4-d4af-4983-bec3-0a858b8e6fd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187645, "uuid": "f8c5f629-6ae7-4058-a2a7-960925780177", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89eea41b-37ff-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776170609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170609, "uuid": "7ebdbc43-f85b-4e0b-a47b-dec4974b973c", "comment": "Malware payload (RemcosRAT)", "value": "a985a458736d0bb7b27db32b3a7773ed", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170609, "uuid": "9adcba0e-d741-4fe4-90f4-d59e37e9e568", "comment": "Malware payload (RemcosRAT)", "value": "589451cb37604823b4e83b230fa89c2cb991657b322aaa761011e1b39d67f1ac", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170609, "uuid": "5a7711e0-e27a-4a9b-8add-e4b8cd0e89f4", "comment": "Malware payload (RemcosRAT)", "value": "94952335a526d297cbf39b2445cceaf757d5ded0", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170609, "uuid": "352bf2a2-e4ea-4894-b0d4-78561ec37758", "comment": "Malware payload (RemcosRAT)", "value": "b1e895eb08f61317ac47fabe9ccaba5c6289b0d33ebf87a46050486931d12802bc6c6d839cf54cfda7e6bd3fe8e9e78c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170609, "uuid": "160aac46-9105-4cff-ab28-6a85dba50674", "value": "T1345490BD854849E6102D6AAC843E4A4EA3E021FB045E97D757537ED3F11EFDAC2C3A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170609, "uuid": "c8fab82f-e63c-4d21-9bdf-191254df1d51", "value": "768:7222222222222222222222222222222222222222222222222222222222222221:+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170609, "uuid": "013bbafd-c98d-4974-8045-561ad7334a93", "value": 281772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170609, "uuid": "7ba929dc-209c-487f-9bbd-c4a6e24b1fc1", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170609, "uuid": "e8aa774e-5bf9-4965-b701-b5933c9a2aad", "value": "goodgirlformygirltobe.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245a5cc8-37c8-11f1-a769-42010a9c0008", "comment": "Malware payload (LodaRAT)", "timestamp": 1776146816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146816, "uuid": "c4d0310b-8a81-45b8-b03a-a62cba15d412", "comment": "Malware payload (LodaRAT)", "value": "89716337ba0996f411225e110a3c0de7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146816, "uuid": "77bed6b3-0f50-466c-a7e5-c433b0ba4464", "comment": "Malware payload (LodaRAT)", "value": "58e3a3cd1bde298004bff75db60ebfe13f2dc9ee17d8c80f7c249651bc27900b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146816, "uuid": "7cda3959-8186-4068-88f4-f15a1c28e398", "comment": "Malware payload (LodaRAT)", "value": "abb8876ba594cb89bc8e56dde8140ef31caa8803", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146816, "uuid": "9c2e1df6-95b2-48e8-9840-4502e8636145", "comment": "Malware payload (LodaRAT)", "value": "f3414bdd42075e62a64fd704230f1c188ac8363fd7f385a2e0c5402b281d0df6bae60736b9862c237005a66889b1e6f0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "LodaRAT", "colour": "#DEDEF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146816, "uuid": "5d50dce9-6662-4201-95c8-c7e848ca4542", "value": "T12D34237CEA483278E762817428B52479D5FF120E850CC8AF3DC6A155D7ADB1E42A13FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146816, "uuid": "244d9858-c2b9-481f-b99f-9f7e23a589f1", "value": "6144:qzqjJhbuWg8rii9dgyOxYFaG0gO1lRGDuv1DE:Zjzbn5isdIYFaGmRGDuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776146816, "uuid": "7c59ccd7-9b23-4c26-8909-1fa097f54234", "value": 243080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776146816, "uuid": "8119d41a-7e19-4625-b6f4-89e9e94a5c78", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146816, "uuid": "bc5058da-882d-4ca9-871c-091acc3ecf06", "value": "Detalles_de_reservaci\u00f3n_para_11_hu\u00e9spedes_e_informaci\u00f3n_de_tarjeta_de_cr\u00e9dito.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b550471-382f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776191012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191012, "uuid": "95a84c61-1466-4df4-99ba-3e4ea219df5f", "comment": "Malware payload", "value": "0db84a1f2a01e3ad518e4175f15deebc", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191012, "uuid": "4f710d3e-7a7b-4ff0-9b8a-4356d438c081", "comment": "Malware payload", "value": "58fb2dccb78634036edf6d227a90f31fa93ec61d1f092a7eef5a66a2e6f2c8d1", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191012, "uuid": "6adcf957-c679-40b4-a638-d77abd2f765f", "comment": "Malware payload", "value": "ed9b67eb2aa040987d33f1b9276af999e3ef633a", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191012, "uuid": "fa7a319d-8eee-48c2-83de-a88798ec2d05", "comment": "Malware payload", "value": "1b0df84ad20f56387a55d64a051ec5c241f84f2fb26a819ea5457256c3c5d9037d029f2f3e36b52da96afcd5bdcee972", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191012, "uuid": "2d0f0c1a-5502-4f9e-8b28-275f77cbb901", "value": "T152418E56210227684D35746475B246C3DE07E88F2FA0F2C57988653C2F1AF954BABCBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191012, "uuid": "cb25286e-0b73-4640-87a8-7a785c9f0d21", "value": "48:C70ldUDxSppgiCC0eGsTtR0pmpyjmtRkmL6b:a0DFngG3Z5QmtG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191012, "uuid": "e9685d9a-e94c-4cb8-a095-15a240312ae5", "value": 2054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191012, "uuid": "5c7c80d8-7f28-4fb1-b511-3407c4b2a233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191012, "uuid": "4fdabf0f-8fe7-4c9d-a110-ca36f3210b30", "value": "58fb2dccb78634036edf6d227a90f31fa93ec61d1f092a7eef5a66a2e6f2c8d1.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f91fc0-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776175386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175386, "uuid": "d07ebeff-f55d-4ac3-9a43-79b41b0c803a", "comment": "Malware payload (QuasarRAT)", "value": "4834e38643e869c08f82d33d44ae1a89", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175386, "uuid": "cbb7fca8-ec2a-4c72-9d83-b94312eb231a", "comment": "Malware payload (QuasarRAT)", "value": "59057eb3a372cf2cd76e9bc534d64c44138b11f846b907ff8befcadba5fac988", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175386, "uuid": "c342877e-31e8-4c48-8fb8-2fb387f010d5", "comment": "Malware payload (QuasarRAT)", "value": "f0406f082aad64b71729f5f33346668d5363865e", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175386, "uuid": "316be151-8b6f-4f0d-bf22-e537147a9c33", "comment": "Malware payload (QuasarRAT)", "value": "0c5eaa6f5d95930a9c42fbcbf2cf8b7c8fa2477b2240e83c56c80580cead90d58f7e7d3064fcf8ae1a48bfe9a62fc0b8", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175386, "uuid": "9c78f04b-73cb-4be0-871e-a9339d1280dc", "value": "T197E55B103BF89F22E1BFE672D5B1001663F1F82AB363E71B254167BD1C53B5099426AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175386, "uuid": "ab0521e5-dbf8-4fad-ae4a-e81bae0f2253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175386, "uuid": "6c1817ad-3768-480e-bf56-f60794177a61", "value": "49152:6nxIdotKb3kpiRlkfFJe+6rxoax4HHB72eh2NT:6nxJtKb3kpiR2fFQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175386, "uuid": "a336b978-49c3-4c62-9b5f-0ca970d94505", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175386, "uuid": "40a8cdaa-6a04-4b33-aa56-0c5cc7052f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175386, "uuid": "7df826c7-419f-4fda-a3df-9675b036171f", "value": "aIg.exe.88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa3aa4c-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776175263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175263, "uuid": "34fac91c-b8dc-4ccd-ab4e-a860af0368a0", "comment": "Malware payload (LummaStealer)", "value": "a96844713ce7d1a4959a4b0a79e3f0df", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175263, "uuid": "f312057d-a9ed-4d20-a38e-7af7297fbcf4", "comment": "Malware payload (LummaStealer)", "value": "590dcc766e1b9c6872812e2ab563560bc77df1a4c888aa9f907099d0f30f8e14", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175263, "uuid": "fd1991d1-feeb-483c-98ca-d03bee8181e3", "comment": "Malware payload (LummaStealer)", "value": "8d1d16da74970e2dba398068443f2b9fbb5eb41e", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175263, "uuid": "de233ae3-0946-4bc7-999e-31081434d2ed", "comment": "Malware payload (LummaStealer)", "value": "361c378a089d4399f113c48feed26d4e5b52c8eb29e38ddde1562da581b22a0cb91a326366361579647f9a9ed1e7aa9c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175263, "uuid": "3d42f669-4537-425d-b5c8-03bb3c69850c", "value": "T194B57C00FD9764F2E90B573655AB63AF2735AD040B326ADBEE507E38B9736900C72349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175263, "uuid": "7f47b958-4e04-4704-b66d-94a80291dbda", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175263, "uuid": "7cf0deef-43aa-4aa5-959c-d65c1877493f", "value": "24576:jcKnjvM2GlWg/L4TvGwgPW9yyjTUd6m2zJUuf+4jKdQSiwa62bKGQ3Yx+tj7qTOa:jvj3VgWUT4mdIZfIXgbQ0tlN1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175263, "uuid": "8b28226a-b3fe-4bcd-88f1-5e1579b518a4", "value": 2413056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175263, "uuid": "0a6b1c9a-b529-4a4c-ac84-ca5bbf8a8920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175263, "uuid": "29055a09-0b71-4980-b785-b8b97d235e77", "value": "recuva_professional__technician_(2024)_full_espa\u00f1ol_[mega].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f55d5f-3823-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776186016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186016, "uuid": "e94bc871-52c7-4486-a4b1-fc494b021301", "comment": "Malware payload (AgentTesla)", "value": "b59bfe34a8080ffc353913c8e08085f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186016, "uuid": "8fd777ac-651a-48c0-acb4-d189a69de73c", "comment": "Malware payload (AgentTesla)", "value": "594f877327f37b0fc0eadaae07e30ed57913ba5b48be591297dfa5bd41900ddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186016, "uuid": "2d52b907-52d9-424f-8a16-df9da496f13d", "comment": "Malware payload (AgentTesla)", "value": "789b155acc385e8dc8847e9b73820d25db947151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186016, "uuid": "0919031e-e8a1-4404-be9c-fd19ed9d471f", "comment": "Malware payload (AgentTesla)", "value": "6a11ce4eded0a9323c7abda73551158c15960fd664cb45ad5b713d2596760f2fd4ba62fee935d77f97c16fdd98429705", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186016, "uuid": "ccfad443-7c54-48f7-9fc0-3b717caf3932", "value": "T1B8C26B617B5893EFC4C2E1748F33E95C2E357E7F9818B2FAB28717CB5698900A812175", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186016, "uuid": "fcc16105-4328-47a3-9a76-5069f8c164d0", "value": "384:6aLXZwAW/pEdak5WQkTCqx1knZDimNFKICXPVpjV3la5q/iejh6G/zJJJeo:dLpbdaMkTr4NR2rV1a5beV7JJJeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776186016, "uuid": "d437a117-0aa6-4844-9b23-7e2644576358", "value": 26228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776186016, "uuid": "0f5cb157-bb4e-4d1c-b80a-2530884ce752", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186016, "uuid": "20412bc8-4cf2-4bee-9d67-3a98ca36f45f", "value": "nFormulario_de_.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7e051b-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776175261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175261, "uuid": "940c1ec7-8b83-4dcf-8bb8-937916b79834", "comment": "Malware payload (ACRStealer)", "value": "5489cf0671b539db41776e4e612ea031", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175261, "uuid": "b05bc6ef-826f-4f2c-bb67-40ee22733edb", "comment": "Malware payload (ACRStealer)", "value": "59c71bceca62f570b146021b3f51b55d28a5323c4106350ee4d5f5514c4549d9", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175261, "uuid": "dfc8a4ce-95fb-4545-8944-03b8f3a1418f", "comment": "Malware payload (ACRStealer)", "value": "1f816541888f1a67b356d46a7abd6cdfeb36df41", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175261, "uuid": "f35f5cfc-f524-495c-99d2-6ca041f290d5", "comment": "Malware payload (ACRStealer)", "value": "75721cf78a3df9746851b16e5b7253a878ee2b4627987e3d7f6213ee289f556e4e40cf83768ed917a91067ef22cb1452", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-RenPyLoader", "colour": "#C14D39", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175261, "uuid": "7dd00e6e-3d5e-4a80-8663-db48613bb65d", "value": "T1D7F67A51FACB94F6E9832A3045ABB22F633859014B35CBC7E7547B2AF9376D54837202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175261, "uuid": "6cddd4f9-5d3d-41af-84da-bae067ad7911", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175261, "uuid": "04fc76a8-945f-47d6-b383-e44847ee0b59", "value": "196608:ImxXD7Q3OPU+xBbKgsD40x7UEYRykbdYYOimgB9MN2GMdRlD:XgH+bKgsvx7UEYrdXObGMcxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175261, "uuid": "3ce028d8-eca5-42af-939f-63b8ef6a4569", "value": 16244312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175261, "uuid": "c6d12259-aa52-4609-bf04-e6524819c18b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175261, "uuid": "1f4f5a69-dc7c-4090-b177-4c1f8e83d6ec", "value": "crepectl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85371c25-3828-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776188211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188211, "uuid": "9c47ccf1-e102-49eb-b547-5b86af7bec23", "comment": "Malware payload (Mirai)", "value": "3f56b900da76204b933bea6d93ab042c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188211, "uuid": "a7d5c0b4-6dce-4c8a-a448-633d49473189", "comment": "Malware payload (Mirai)", "value": "59e2440f939fd742d7c09526512efbfebe7b9a4cacea874a8e6a5773e61dcb3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188211, "uuid": "1bc012ac-c354-4065-b2d8-9d58d0a4ff3a", "comment": "Malware payload (Mirai)", "value": "704646027aff5c7267da9210d5f45976ed8da2db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776188211, "uuid": "6818c159-271d-44b9-b60c-0e15368a7be4", "comment": "Malware payload (Mirai)", "value": "900da0d04aca5de456305c7171807af9fbdcc964b67362e90ec234ee66eed6c1f5a0d507f2e04c18bc139e3bf9d5950a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188211, "uuid": "eb4c4544-0940-45b5-b008-4ac9aed7272e", "value": "T182144B45F8818F26C6D012BEFE1D118E33272BB8E1DE72129D245F65778B86B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188211, "uuid": "75aca106-2c31-46c1-a983-3a7a5de6f4a5", "value": "3072:/KwO38UOHdy8J4bscaHcN01E6XxLeay5ai4vi8TOqZ68LC2QiT:/K/OM8Ss40vXBeBaN3qqZBC2Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776188211, "uuid": "e35fd3ac-7a7c-42be-a810-a10f691f6b73", "value": 206396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776188211, "uuid": "6042e265-bf8a-4308-9ac1-1289d6b129dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776188211, "uuid": "0c1733a6-869d-42b6-987d-4d257a628950", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3aa3a6d-37cb-11f1-a769-42010a9c0008", "comment": "Malware payload (Loda)", "timestamp": 1776148426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148426, "uuid": "a12a880b-3184-45c2-95aa-89471c37c6fe", "comment": "Malware payload (Loda)", "value": "fd0d553d1740ea9d2fafdaaf7f613ca9", "object_relation": "md5", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148426, "uuid": "95528f40-0501-4856-a1a6-d53e84649c12", "comment": "Malware payload (Loda)", "value": "5a5efbeb62c76791f96b7c58b6041b2ee15e51d11a38c8c15b6a76afddd8200f", "object_relation": "sha256", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148426, "uuid": "9afd2a74-9984-46c5-89ae-1789962216cb", "comment": "Malware payload (Loda)", "value": "d34d16f9731965778df2bcb78dc757b3ca01bc65", "object_relation": "sha1", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148426, "uuid": "cd686ab9-ba26-4365-b3f1-9545e2634ea4", "comment": "Malware payload (Loda)", "value": "e0b308d402bd92e7e6409cf2a32777024064361a1562c35738c27c6f28d1f099186437e459e657255e4a12bd22b8a2ad", "object_relation": "sha3-384", "Tag": [ { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148426, "uuid": "f96a50e2-2bc1-4875-b838-ec9c0c1438bb", "value": "T183C6335F2DDB81D6D98134B48B1B7BE323F37DD249898C396AC2750871B2F72311A686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148426, "uuid": "07ad3132-3126-4be2-8884-558d574d7373", "value": "196608:53WQsZdQdCWsigczf6jX+76sf8+LD5LJC9MbfW+9zWOH6jt:5Nw+fZgYfZuslFLgOZ9zWOax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776148426, "uuid": "fb7667ab-24a1-4d7e-91e6-1f298a0095b6", "value": 11587584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776148426, "uuid": "3535c276-7c28-4b1e-baaa-4af84afbad50", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148426, "uuid": "60604889-6de0-444d-8b4a-7a7e5d9e64c0", "value": "SecuriteInfo.com.FileRepMalware.78955359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e00a0084-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776157869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157869, "uuid": "e141bb91-aff8-4f07-8fd5-ef2852272a84", "comment": "Malware payload (Mirai)", "value": "5efea5baff72525ae4d26a2b2eae20fe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157869, "uuid": "8007a53c-08a9-49bb-be5d-81e200674f33", "comment": "Malware payload (Mirai)", "value": "5c03b8d9830a9f5a0f6844a5180fdaa95dd1973f8aca00b2ce4e57cf8304380e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157869, "uuid": "edaecad1-2619-451c-a7c5-099e771ce6fc", "comment": "Malware payload (Mirai)", "value": "a0b0f2f6e8a1d055d59d854bbbfa344bbfa80b02", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157869, "uuid": "6f999126-5b6e-4219-89e7-8ef746729692", "comment": "Malware payload (Mirai)", "value": "5204a5fb7716fc896f178e9929286e88fff9ddfd33de81b42ea7640c167167dee72f26f78298d979017054e3f73dda0b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157869, "uuid": "2d82a8b9-6354-4731-9a52-86467baa5f4f", "value": "T10E111ECE21A072A788ECDE14716EDA089448DBC230A51F5C9C8D29B3EBD4D14F959F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157869, "uuid": "859c34f8-7d49-4f7a-962c-3f31761ae574", "value": "24:8TEoTS/TKNI7hT/qKoktBlT40en3FoQlbAbpn:8TEoTS/TDhTiPKlT40i3FoQl09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157869, "uuid": "a3b88cfd-6b71-4314-b7d7-ae820641e252", "value": 864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157869, "uuid": "83cd74da-7b27-44ac-8db8-914d70a14841", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157869, "uuid": "9f83c207-65a6-404c-adf1-46804625c430", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6fec6e-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1776149756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149756, "uuid": "ac1c8c8e-80af-4536-825b-11aad59fbf2f", "comment": "Malware payload (VIPKeylogger)", "value": "b7b5bced0e981fc724f5d56a80baf600", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149756, "uuid": "be367fc6-00f5-46f7-b718-e84dc47c2157", "comment": "Malware payload (VIPKeylogger)", "value": "5cd874e137af5cfd3575b9ce444fac3905a167e73db85e849c7681c9120d2fcf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149756, "uuid": "51bd898e-cd5f-401e-901d-64ce8db14822", "comment": "Malware payload (VIPKeylogger)", "value": "0022d50093bfa11aefae38a3427499c5ed9de2b6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149756, "uuid": "2a12e39b-b950-4f8e-93c0-4e202f8ed6c5", "comment": "Malware payload (VIPKeylogger)", "value": "e331f7a2923527f1eaa2dd3cf598ddb9231d15c976027f2edf7aeb84fd877a744712ef56119af5882e34d0c571cf43e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149756, "uuid": "8135721b-ce5a-44c7-b643-6361d7222d89", "value": "T1C256A604C0A4B11D59C3DF5EAA76F4B08C8F356A5E4D8EB3642F81BC1C9AF974911A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149756, "uuid": "fac27927-9aaa-44c9-b17d-03800405cd4b", "value": "196608:X1TWrU807sRRdbKh8C3rsIjlmrrJUPtty9cVcE:lTWrU1IRjKh8KrsUmfJat2cVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149756, "uuid": "3a24bd4b-d3f1-4e95-9307-15581a8d067d", "value": 6324906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149756, "uuid": "38ac6780-d323-4eb9-ac59-4429a6ac0ee7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149756, "uuid": "59d9a45c-c5ee-4ad3-b0f1-b6136d8bde64", "value": "RFQ_2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018b5d7d-37cf-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776149764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149764, "uuid": "08222f04-ec4f-473e-a875-cac70e518b59", "comment": "Malware payload (Formbook)", "value": "c41cac96f1083ef3b9fe48567ce73854", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149764, "uuid": "1c6d2593-e4c5-409e-83bb-395128ba405d", "comment": "Malware payload (Formbook)", "value": "5e0a211f65b87058b915295d6c3f7cfffb05a4df26e151b9385dcf8b872c10cf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149764, "uuid": "ed2bd3d8-defa-48c6-aedc-22e97449aca1", "comment": "Malware payload (Formbook)", "value": "bf0ea502001eb8042757be230309b031ea35c0e6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149764, "uuid": "947e4c49-bc1b-4973-b36a-141736206a1f", "comment": "Malware payload (Formbook)", "value": "13e88cb498b11bbc56b7fe203eb0e30104ee7e00e86a64fea48c7d5b1b18d6aca070ed6efddcba69603b2765d7d84bf4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149764, "uuid": "26aa6170-c02d-44c7-9539-258bc73f4d88", "value": "T13A5387842A93F038CE15942A450A265B6F0B7E7E8A1D7D75E23F658B9AEF0F403C4C57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149764, "uuid": "18cc5cb1-eea6-47c5-9c36-1e03b18431b0", "value": "768:P7TbFHJVBE3RviAY/vNngrkBgrr+0TsUDYPIYjg9jXCuPoWPwxrMNX:BHJx3hrMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149764, "uuid": "ba619321-7a37-49f8-96ee-3fe41654de47", "value": 62949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149764, "uuid": "106b41d5-201b-4d33-89c9-07b8b906a7fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149764, "uuid": "ce24dffa-8564-4100-8220-d294e175f8d8", "value": "Purchase order PO_NO301629.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be1490b-37e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776159311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159311, "uuid": "d3b7d589-a74b-4495-8de9-4f599ccc42a1", "comment": "Malware payload (Tofsee)", "value": "df89e159004e72e4617e96e53ee9d52b", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "quag-cn", "colour": "#BB17A9", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159311, "uuid": "3ce9965c-3fd6-455a-9bb6-a29d59acb448", "comment": "Malware payload (Tofsee)", "value": "5ec30eee79375992113484eb74be32aa78cbc2ddc1f7d59cd1f06c54cd916d4c", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "quag-cn", "colour": "#BB17A9", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159311, "uuid": "d9da213a-5a50-4c50-944b-50360ae020c4", "comment": "Malware payload (Tofsee)", "value": "8755fd2554533e2b3a01788c2089de07e93c7a09", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "quag-cn", "colour": "#BB17A9", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776159311, "uuid": "884894c2-8eb1-4d6b-85d2-6df66f029ede", "comment": "Malware payload (Tofsee)", "value": "8287f600de3a66558d6834fb19610adbd1fb5f15a9a28fbd6be22628529a744f180563cac6d045f7114b53ba3597ae30", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "quag-cn", "colour": "#BB17A9", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159311, "uuid": "61ff8a05-6374-451c-83e0-f40afc6924c1", "value": "T1EFA6F133A28A663DE06A0A3745B2B230993B6E51654F8C42D5E87C5CCF3B1E03D7E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159311, "uuid": "0161c828-a864-4372-a0d6-a3c750a39de4", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159311, "uuid": "c7edb4a2-b424-4a4a-8a17-5bbcbf375ad7", "value": "98304:eN66Evb/2aPty+s0es+yXzx5oZXTwIblOIf+AkoyCHYQ:eEvb/xQ+s0d+U7oJkslOJAkoyC4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776159311, "uuid": "62d54768-4455-4b6f-927a-5718dfaa8efe", "value": 10009586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776159311, "uuid": "99dd098a-81d9-4280-b828-7d2bf1bd8733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776159311, "uuid": "8b9862f2-ba03-463d-a799-1700ae822400", "value": "21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a744b33c-37ac-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776135010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776135010, "uuid": "26844e8a-2652-4456-bc08-9f2e22d17eaa", "comment": "Malware payload (AsyncRAT)", "value": "1020c55c5a5cfa36f8999927d1da94bd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776135010, "uuid": "d6a8615d-a8f8-45a0-962d-da9963954453", "comment": "Malware payload (AsyncRAT)", "value": "5f9f9b11d66f51e06801468019ca6a43ce4bce0fd1bbdf12c3863c7252a37096", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776135010, "uuid": "ea213400-7663-43ce-9cbe-71af6eab9b50", "comment": "Malware payload (AsyncRAT)", "value": "af73f9baf1ca594d3cbd6efddd879b1abf50b918", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776135010, "uuid": "0e0c2461-e8c6-42dc-8027-0f755dbaaa70", "comment": "Malware payload (AsyncRAT)", "value": "34642052216630dc5a0d34a2982da4a12fe6803238cac7e408a05b030b53789ac9dee9f28aeb32695b5aba929b9a290a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776135010, "uuid": "5cd44746-6f5a-4937-9d25-90bc2e22ab41", "value": "T1FD233B0437E9812BF2BE4FB8ADF22105857AF5632606D54A1CC451DB5B23FC2DA42AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776135010, "uuid": "59de0e72-c8e2-48e3-896e-8ab87b4f650e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776135010, "uuid": "e88375df-a80d-4d85-bc85-4b436632fe69", "value": "768:12u/dRTUo0HQbWUnmjSmo2qMvhufrhiSNmGRS5PIk4/yE4b0bSAgEqVA/R7guBhV:12u/dRTUPE20iUmGxZfbSAgZVAZZB7U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776135010, "uuid": "1f5b6a74-9631-4029-ae0c-87d8246bf92d", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776135010, "uuid": "c3f8ab00-f663-41b9-88cc-0c33888f7edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776135010, "uuid": "68c8aa5e-1381-4d76-90c2-00f1a1cc1e27", "value": "1020c55c5a5cfa36f8999927d1da94bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1dc78ba-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776149738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149738, "uuid": "256e699b-70ef-45c4-bff9-aac3addff391", "comment": "Malware payload (AgentTesla)", "value": "81950565ec0ae19b8feff7c720a742eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149738, "uuid": "5a60ea13-c385-4355-bead-8e84bde805d4", "comment": "Malware payload (AgentTesla)", "value": "61633f15878a2dbc10c09747e3712c5a10b4808830290e862058d2cdc8435137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149738, "uuid": "589d4331-2210-4e0a-8d2c-6fb7afa41505", "comment": "Malware payload (AgentTesla)", "value": "82e2922917aedf12e184c64ca33ecac356e33656", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149738, "uuid": "453f78eb-6d89-405c-84b7-ca8334fdfebd", "comment": "Malware payload (AgentTesla)", "value": "b85bc755e78ae7b5f59060aec988ad39a710ce7413b5d77f9cc4ad3218f8b41c4d2672f91e757ee93d8b68f411e18743", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149738, "uuid": "ff35b528-546a-475f-bd6d-d95f424bec2f", "value": "T1B0D5735C4ADEAE143D2153388DD136F2AF5C86DA9A3A1F68472C15E0C2C6FCC74A9ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149738, "uuid": "2548dfb9-d242-4c8c-9fa8-f8f76c0d453e", "value": "1536:uqLsQmv5qlS/zRdkw9UF2qvpqmRDPqM4J9S3S/Bkz6/YMLqPjfMrqikVZqjKoHq+:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149738, "uuid": "3e1bcd87-9d5c-4c4a-b78d-f045349e21e4", "value": 2856707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149738, "uuid": "8706eb4c-4379-4197-9e4e-136f7e0f481c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149738, "uuid": "5c07fe33-5248-47e2-a659-1310c02a4ade", "value": "Comprobante de pago (TRANSFERENCIA).xml.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f6ffe0-37f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776163938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163938, "uuid": "1871e931-66e4-441e-bcef-499726b4c758", "comment": "Malware payload", "value": "3d55b188b1b2e0e760d335e48eada95b", "object_relation": "md5", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163938, "uuid": "d1049d07-9d67-4b54-a5ef-2c602d63071d", "comment": "Malware payload", "value": "61b82798d812b2d4702dc1468fbada46e2f72e4d5b2598533ddbc33ac2fc843d", "object_relation": "sha256", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163938, "uuid": "75bf76ee-6dcb-48f1-89c8-a56edd2db8cc", "comment": "Malware payload", "value": "65251efe5460de92d826da52c75482d761772d42", "object_relation": "sha1", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163938, "uuid": "ec4321bb-dd15-4e22-8d9c-f1898a4eb64b", "comment": "Malware payload", "value": "1152f60620de693717876a7466e6429e0069c8229ac6b1b3acb3e250adb3884d7a21c0c5f8c78955baa839b41a196f70", "object_relation": "sha3-384", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163938, "uuid": "09a3df56-02ee-4572-a2e3-5e868bfa8017", "value": "T135449D39462B0883CFC70E70F17F2B1967269E4C571AAAA5A314B318DE7EB9354F5123", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163938, "uuid": "bcb798c6-ceaf-483f-9045-b65da91190bf", "value": "1c0125c1b1363cfc15d52ee4fa4ca4bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163938, "uuid": "ea667ac0-ebf7-4777-b85a-4667f531b77d", "value": "6144:k3Rwe/0K2TsvAW6gU9iwVHupAypZwooiUR23Vmj7ToiUR23Vmj75f:Cf/0K2TsvAVgU9iwVHupAypZw5i9mj7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163938, "uuid": "3859c803-7f31-461e-a634-4372a55738e3", "value": 270944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163938, "uuid": "c4a42ab8-726b-44a1-9094-e79576d449ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163938, "uuid": "b3808353-cf83-44c4-855a-9c85812088a9", "value": "61b82798d812b2d4702dc1468fbada46e2f72e4d5b2598533ddbc33ac2fc843d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a1096c-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776195598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195598, "uuid": "074d75d0-8b92-4f93-8150-2124b3e63dc8", "comment": "Malware payload (AsyncRAT)", "value": "44dafa00f4862bddc6a6b78d3ced1474", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195598, "uuid": "4d17dc4e-35f8-46ee-8d87-cfc52173344a", "comment": "Malware payload (AsyncRAT)", "value": "6232e6cb80300814f6b37b330017b2d0c540602f6a2a52fb738d91fe0d713e02", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195598, "uuid": "279cd784-5487-4a7a-9d65-ade29c69781b", "comment": "Malware payload (AsyncRAT)", "value": "e54ae534c9cb7953f4c0d8298a3f9987e0a27e84", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195598, "uuid": "c4ee3e64-31b3-4761-83fb-61f124b7aed8", "comment": "Malware payload (AsyncRAT)", "value": "973482a4a0820514427c5c5d6c0c2b0cb9f9ea2eff97cbb2ee0099c43ae6345104f7c345dfb28bc93ff752d8f6a4838d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195598, "uuid": "5de20d6a-4065-45db-817c-f0d42272cb16", "value": "T136232A0037E8812BF2BE5F78A8F261454A7EF2633603D9891CC451DB5713BC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195598, "uuid": "00f8f469-fc98-4625-9a60-f0a94e83f666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195598, "uuid": "12eff60b-a443-43f1-9689-56d1ac7f465c", "value": "768:5uKQ9TH4EjZWUR/ejmo2qrj4opxVDpPLOOPIyzjbmgd3inwnkg3RkKsBDZLx:5uKQ9THfe2A4opA3y3b5dSsp3nqdLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195598, "uuid": "633f4356-1cc5-4009-bb29-d4b45509cdac", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195598, "uuid": "5b783bdb-eff3-4c53-af0d-825553e5aa5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195598, "uuid": "5f679753-e017-4304-8515-9313671092aa", "value": "swchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692e0fd9-37e3-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1776158528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158528, "uuid": "0e01dd9c-ace0-488f-89f9-13863d128787", "comment": "Malware payload (WallStealer)", "value": "137f88c1e28511543b696e63f57e0182", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158528, "uuid": "0a833086-1581-458b-8c78-99ed14a5b01a", "comment": "Malware payload (WallStealer)", "value": "626ac4281b5a2bdd8b02429f1c4d595dd04d2c03200e64f9b6537bd2bb7c80fe", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158528, "uuid": "cfca8fc6-d307-40cb-bc97-96909668628f", "comment": "Malware payload (WallStealer)", "value": "34bedea262a51456d59f88a7c242315f34947e39", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158528, "uuid": "520d36ed-bf2f-4af4-ab00-09a7009baa15", "comment": "Malware payload (WallStealer)", "value": "ebe629fb9d176c73caa2a47cbedf994b23565dcaa00687fad00c0a86d82b52de5eb4504588f182b4567c7771a67b4a86", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158528, "uuid": "913812c9-7fed-4d03-bf8d-ca3cec11a5b0", "value": "T1C636E102E2974ADEC46BC0F8C5112E67F4BE78310A28AB366BD84B646B53B3057FD745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158528, "uuid": "e905b163-1cdf-40ed-b80c-6909e034b2cc", "value": "c05cf134dc19034ad65ea00a44098560", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158528, "uuid": "d4e86f97-e751-4b7b-9621-dbe0730e15f6", "value": "49152:rLl7vZMSM0VmI2z24jI00zIv53v+TK+Opx+GXOHWn4NKe6f/IlJUusf1DKjmlfUe:tGTdOHlNiglO7VKjAfrlylKeKK+4QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158528, "uuid": "688f274f-daf0-4408-8b94-02732bb2a47a", "value": 5264912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158528, "uuid": "279b310a-4ece-4359-a450-c43af51891c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158528, "uuid": "dfaacac6-eb0c-4c1b-98c3-a3d202ef60a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde6dcfe-380f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776177676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177676, "uuid": "2a65b7f9-6933-4b09-9615-beca59bec78d", "comment": "Malware payload", "value": "bd1beaa94d4a09d359f46d9c9643005c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177676, "uuid": "04ab6c79-1ea5-4981-aafa-055ee95893f3", "comment": "Malware payload", "value": "631b5a20174c6e5846dc03238cbaa199c84c979ae4783e75bfa81dd8d2fc7d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177676, "uuid": "962866c4-a4d3-4e87-9a06-6698a41f65a9", "comment": "Malware payload", "value": "edb339690a1b964ba4a34ed3d79edfb52694ce1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177676, "uuid": "fafeb80f-14e3-4378-8cf8-cdd28d5ff19c", "comment": "Malware payload", "value": "5ea687a41304e890016e1fb85e0b690dffe7aa3a009edb2360d937a2e974b5ebe96b12abb1f69e376d005bc27cbd5035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177676, "uuid": "93b4c0c7-3d74-4e02-97d0-110e0dac014a", "value": "T16BD4194673A49AEADC12A63C96CF6319B235FCA0079396D7972012215E47BE8DD3FF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177676, "uuid": "6bd67409-6734-4beb-bc7f-cd7d933b6f9e", "value": "6a8a9061d0295482bd706f905eb90903", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177676, "uuid": "88d453a3-c272-4ee7-87a6-69d2aa2bc800", "value": "6144:2ENrXAw+7eEDy85zg8YOeZ+DyyvlftNcbnSWqqHnAVrJRyOQEwb9f0ZZOG3c2FnA:9NzAw+XUkDySTpTOZZ1OTKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776177676, "uuid": "337e6650-627c-4f1b-8927-ca6aef0c0dc6", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776177676, "uuid": "fb2bb929-19f5-4405-952b-297c64df7430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177676, "uuid": "41991e44-c3a9-40ea-8bb8-a16035e13a64", "value": "notepad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e307c464-37a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130386, "uuid": "99deaa23-9fa8-4f76-ba40-348ee32c4f42", "comment": "Malware payload (Mirai)", "value": "f0af122eef7189ffb37fc130eca7adde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130386, "uuid": "dceadb4f-1fd9-4e03-910f-b4d10581e9b1", "comment": "Malware payload (Mirai)", "value": "639ae9081784bf5c56b6033b7673586fde9d27f1727e2e9640a23c1064b90dfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130386, "uuid": "b757b596-e1af-4a80-8de4-61b5f2de0e95", "comment": "Malware payload (Mirai)", "value": "e53ce7bee21792089cef8b663c43d5cd4dd76eb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130386, "uuid": "03244ca9-750f-4098-8b62-09732d63d005", "comment": "Malware payload (Mirai)", "value": "0a43b50f059a1385db5a75c3e42625324ffb17a825c2b7c5f5ed8ade42ff08b1e450d1bc5e6d201ae3fe93c0cd1692a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130386, "uuid": "a25d0609-cba0-45a0-adff-ec6b340fa85d", "value": "T1DFB33B46EB818B13C4D5177ABAEF42453323A71493DB730689186FB43F86BAF4E63506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130386, "uuid": "719beefb-6f29-447f-80d5-f3a65f9de162", "value": "3072:7ooFfcwB8lNYJcbRU53UngjmJ5AM/9w9Bl:soFfcwB84JcbRUhUymJGM/9Al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130386, "uuid": "7a263f88-a84b-4f11-9e02-3de2d81df1b7", "value": 114576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130386, "uuid": "cdaa931b-cc83-484c-9a13-79a807e374fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130386, "uuid": "9ab07ec2-c78b-45df-b2b0-eea4a1a417e1", "value": "0uparm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b88b1c-37ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776170550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170550, "uuid": "e40e3681-da41-46af-ae2e-39cc8eed9c09", "comment": "Malware payload", "value": "8a3341ea5b327d4c37cc2f6f40324e10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170550, "uuid": "d227c115-4d8b-4e6c-a09b-729b2e3c64be", "comment": "Malware payload", "value": "63ec5b7d273e1aaf95dbbd10d439616016261b456a9f63dd0d36058e73a17f52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170550, "uuid": "c989463b-31a9-43a7-b81f-a06bac15b9a0", "comment": "Malware payload", "value": "c28fae5d8145ddaef49d53c5ef1e40c30a1422dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170550, "uuid": "8c1c6fb1-25a6-4ae4-8097-222931039d6b", "comment": "Malware payload", "value": "6025cb281731505b3005295081962af560bf7da773d7b79fde86f97e923b7635ddb8f2ffe7e4b037979ae7b09d019157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170550, "uuid": "5f9d2b5f-3b1e-4ee6-b527-e0fac11cf18e", "value": "T1A2357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170550, "uuid": "63b062c8-4c5e-461c-9a72-bcbd28e1a020", "value": "73f461c771aef77ec43d53a0c54f0c8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170550, "uuid": "97c01102-87ee-43c0-81ff-111b2f76a537", "value": "12288:Obs/m0E54jwaFXGc8lEBBBHGBKq2IZwD6vfqItNqdg:ObOVE5ifGPRZwWvf3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170550, "uuid": "3b4f95d4-5607-4161-b473-69b5fd89f8b2", "value": 1139712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170550, "uuid": "6fbc7fef-6781-48ea-9d57-5d33d8ced03a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170550, "uuid": "0c0130fe-8fdc-4bae-8b22-6867e8459b36", "value": "ZyroAim-Valorant.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ff463c-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127215, "uuid": "f1e9aa12-686e-45f2-948d-0f65e6a8805d", "comment": "Malware payload (Mirai)", "value": "d4c9b397ed9fbbc97af250c64720bfd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127215, "uuid": "20e06745-438c-4889-9474-a25252811dd6", "comment": "Malware payload (Mirai)", "value": "6876214d47847c9d09fcc84cca8dc2202f79187a77d3fa05bffcfef93ebe95f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127215, "uuid": "7709a392-f25b-4308-9ca3-f1c7d262432b", "comment": "Malware payload (Mirai)", "value": "268a3e25c97ddbbf61099c18fc8d40b79b40e312", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127215, "uuid": "ab47a57a-59d7-4b66-80c4-be65c7b520a8", "comment": "Malware payload (Mirai)", "value": "0f30b9e97bf7f78ca127065f1a7a8c13412f4ce5778f554e7863cc3b182af4a915d224ed5d66dfa71f8a42a0b8d203ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127215, "uuid": "f04515e7-42fb-44ac-80e4-8815a0474830", "value": "T1109308B1FA878AF6D40345F100F6B63F9B31F92E4435C1AAFB646EA1CB135C52246768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127215, "uuid": "856e45f4-e39a-47ae-bbc4-6528a1025332", "value": "1536:HEOWi8wGIypuyfq+/asX4LWv6PVvtRSqRfi2TNCpsEgDxg:cihGzprfD/asXHS5tRbRKONCae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127215, "uuid": "d27cd96f-9173-476a-8700-d766f01afc64", "value": 90408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127215, "uuid": "98005b94-c38b-4040-903f-b57e5976d483", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127215, "uuid": "b50a4134-e280-4ced-8f8e-092315ff260e", "value": "zyre.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8c9faf-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127186, "uuid": "d0c942bd-6a54-4c88-b42e-2fab129fc28d", "comment": "Malware payload (Mirai)", "value": "a970b7993c42a8372cfe4f2fca711968", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127186, "uuid": "23249d21-c413-4209-a7f6-c8bd7f6d39f3", "comment": "Malware payload (Mirai)", "value": "687c9846d337edeb2c68957dccd59137251a7adb8b2f68c46fc50c16cf33dcf8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127186, "uuid": "de199bd3-540e-4e2d-8c3e-0665098c06e3", "comment": "Malware payload (Mirai)", "value": "61291b8ef3f07601abbd6a1962dd5df17bb65890", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127186, "uuid": "afbfbbb9-508a-4870-93b1-ca7df27b9d2e", "comment": "Malware payload (Mirai)", "value": "5bca06513691864343b0d8c271aaa61feca37d90879bac591e63c811a5c0081cec965c5be111feeb395b6cf1f33269d9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127186, "uuid": "6a86975e-394e-4e0b-807f-7404c6e2f2e4", "value": "T1B471FB852350CB326C6AE9977475534832A1A2C999EBFFE0FFFE7450A48CD50F4486A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127186, "uuid": "9d3bacc6-4298-4878-80a5-03634f4bd06f", "value": "96:W2MC80saW6sNlKXc+Qg9k/kvfkVkq7kVXRkV3DlVkaStIrK40hqCGY26:W2MC80FW6sNlKXcLg9mc8fcXRc3DPka6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127186, "uuid": "d6069530-5fbc-480d-8202-f98cec720a5c", "value": 3734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127186, "uuid": "52916906-86ca-48c8-a940-9857b7e29175", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127186, "uuid": "f023145e-72db-47ff-9247-317f9d4f1633", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4828e6dd-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776157614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157614, "uuid": "a938431e-eed2-424c-92b5-64f4b80421a7", "comment": "Malware payload (LummaStealer)", "value": "1adb8ef60d859c3a70562b2829ebb6af", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157614, "uuid": "fee5cc21-2b5f-4064-9642-80fca7f1d724", "comment": "Malware payload (LummaStealer)", "value": "6889c88bf7397f58e5fd1cbd501fd2f2778f3b3098699e0f3fd31938f520e91a", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157614, "uuid": "5f993c1e-5cfe-45b6-814a-1555321e0236", "comment": "Malware payload (LummaStealer)", "value": "7cb2b73356512b9198b97b5d060db4f89b30e3fe", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157614, "uuid": "d3e7d960-47bb-4747-8938-1ce88a6d020a", "comment": "Malware payload (LummaStealer)", "value": "c8437f474b7b1ef126d3520c781d20345194e468f969f48ba7c8123a96982530ecbeb8472cebacc2c73b39333bd647ba", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157614, "uuid": "72b8a5f0-313c-4ba4-959a-5d10dfa16e7a", "value": "T1B4A67C41FD8794F5EA03197045A7B36FA730AD014B36DBDBEB503B3AE8B72910936285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157614, "uuid": "e75cbbcd-ab7b-4388-a546-7b8537922af0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157614, "uuid": "642f1759-aaac-4155-806f-fd9b2f81f1ff", "value": "98304:dKPbXtIB11QuO/kPglvsqO4jds9EcS1jahchDLupC9XqvWK1b5RTGTcl/eB+LW:Ui1qkPwsDvuzDDLp9Xqvh1tJG+WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157614, "uuid": "803cb304-e29c-4e9c-b098-03d54b9c0fb5", "value": 10412032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157614, "uuid": "77e40562-0c39-4a7a-8d85-7cc5673cf00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157614, "uuid": "2bd68169-ec32-45b4-a993-e9eebb1e004f", "value": "bot_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7304c29a-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127191, "uuid": "0bb29305-fad1-4ce2-ad70-c9c3707d6e21", "comment": "Malware payload (Mirai)", "value": "c003b8838f6166481743ad8ad483896a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127191, "uuid": "bbb9e2e0-7ac9-4acf-a20e-f3bfbd845cb3", "comment": "Malware payload (Mirai)", "value": "68f3603f86dd18028d145a5f615b33fb210c175a4b3bcd5b124679839cede0b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127191, "uuid": "91afa9a8-3c3c-4e94-a721-f69a25de72c2", "comment": "Malware payload (Mirai)", "value": "197e2568100c0b9a9552680c841236953aab808d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127191, "uuid": "fb9970a7-f054-472f-b6fa-d6c6b4f33b24", "comment": "Malware payload (Mirai)", "value": "7b8b04d984fcf00dfc9ce1b65e9229d3a3537df885e52fb7ddb89dc7e555c1f68adf44e3e5d69e32a0732bf072d1df92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127191, "uuid": "71690629-d48b-4b5e-bf65-3eff76208fc0", "value": "T1D9B34A46B9418B02C4C325BAFE6F914D33136BF8D3EF71168D249FA067869E70A3B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127191, "uuid": "5bb994e7-f822-4f69-9dd6-254dcb47cbb0", "value": "1536:dRn9C7uGDn6N6vlDuTyEIrNBZXzBYteNk8N2tNqGmIDQgcYUQM4BkcbU7fkefpfd:pMPOTG5IVm1uKvayqg2YaBScQRRmIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127191, "uuid": "94e940af-490f-43f0-8c45-9190a1af11e5", "value": 111336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127191, "uuid": "dac5e9f0-17d1-4094-b129-ac7fe9a33160", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127191, "uuid": "7df32217-d6d6-4f35-9cd6-f40d90e77a5e", "value": "zyre.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e114f31b-37cb-11f1-a769-42010a9c0008", "comment": "Malware payload (ChromElevator)", "timestamp": 1776148421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148421, "uuid": "ce47639e-199f-4df1-b92a-72c53674e2de", "comment": "Malware payload (ChromElevator)", "value": "6cc530cfaeee9449e848d74aa50997ff", "object_relation": "md5", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148421, "uuid": "663941dc-7a10-4301-9129-44ab40420c52", "comment": "Malware payload (ChromElevator)", "value": "69e8aa04b0b1862009b599e38f78edebd41d2e8ab3545531d71a76661e1d1338", "object_relation": "sha256", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148421, "uuid": "7e74d714-81f1-4abe-b560-89f7c8b08710", "comment": "Malware payload (ChromElevator)", "value": "bea47b5213250dadfa73aeb3a36f3cd724df83eb", "object_relation": "sha1", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776148421, "uuid": "f8fd5887-1c07-49f8-b91e-df5876376600", "comment": "Malware payload (ChromElevator)", "value": "a611dab6898f2bf968d606988fb9e1b9d0f2a655403864bf91a13f654039889eeb2c3109088b21df9f02512a8963aa0e", "object_relation": "sha3-384", "Tag": [ { "name": "ChromElevator", "colour": "#A41172", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148421, "uuid": "0a1894e0-a38c-4b85-ba45-e2805a429379", "value": "T1E7F52319A7E848F9E97B8539CD020982DE32BD550765D6CF07624AA34F77AB0CD3EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148421, "uuid": "a3272508-1e7d-4356-82c0-a728a6c136fd", "value": "98236a5bb699888899f60e3bbfa36dcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148421, "uuid": "714c093a-53ea-4eb7-a3c7-09e5cec9f844", "value": "98304:BOxCtUuwcn4gZTtNq30wRGi112QT4e5g8rPm6:MYZ4Q0112Q1g8rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776148421, "uuid": "81691ea1-d3e7-497a-a788-776af521151f", "value": 3461620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776148421, "uuid": "2a0a0229-3c93-4858-8af2-35549916409b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776148421, "uuid": "53aa242e-f943-4592-81eb-1509f5e1f584", "value": "SecuriteInfo.com.Trojan.DownLoader49.38557.22430.13385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17dc6a08-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776191034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191034, "uuid": "f9f2146d-1842-48fe-a4aa-58ca9df90527", "comment": "Malware payload (SnappyClient)", "value": "562e657688b5f3889d29e1138ae6f7e5", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191034, "uuid": "deab03ac-b724-4888-97b7-c07f150bce63", "comment": "Malware payload (SnappyClient)", "value": "6b2c53eed24e6c3cc29d375a27d14e78416560c3be44a2846610426958c79f7f", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191034, "uuid": "f2c1f49a-8d65-4ef3-8588-1981e65f7186", "comment": "Malware payload (SnappyClient)", "value": "3fafcbca8f15f472d6f64cd50aef9552349eea4d", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191034, "uuid": "e250669a-5afa-48d2-81dc-8f4b231619cc", "comment": "Malware payload (SnappyClient)", "value": "63a1ef6607f223455740169bdfa4e3c08b789da3e2f321183e9fcb9ae06819ace39680ca1158e25d4e0a3aa54e2ee0c2", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191034, "uuid": "d434a0c4-f0d2-4de2-af83-368dea66dc63", "value": "T1B986334579DABC31D20B0073DE12E4690A589C32FF3B7943DB657E8B2A72C06795239D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191034, "uuid": "6d4b7ae7-1720-4d75-a6c7-bfd15b4ca9b4", "value": "196608:2GMsm3KsWMrmQOsW0UuQinWin/3gBIpB6LtGM6uASSujYj90eDep:2vsmH9iQEyH7/wupBl90U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191034, "uuid": "79e0f5d9-d25e-4355-910c-2b1b3210fe44", "value": 7831552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191034, "uuid": "328eadd1-99cd-45e1-b52e-4664208a3da9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191034, "uuid": "c4f7e603-1cbf-4d5c-b686-b53dd8cf26b0", "value": "6b2c53eed24e6c3cc29d375a27d14e78416560c3be44a2846610426958c79f7f.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0289e85-37c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147480, "uuid": "e1b8a0ae-9252-4acf-9bf5-7c4bb74b97a8", "comment": "Malware payload", "value": "fb42ea828f43fcd82948c207671b0bd8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147480, "uuid": "58b33658-d1a3-4835-97d0-5755263f76b8", "comment": "Malware payload", "value": "6b50bf22b745ee8253abb14d7413e811d8e9560212648d7e085bb9354f148e8e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147480, "uuid": "2d10afab-d98d-4569-86c7-c9889ecc6f7e", "comment": "Malware payload", "value": "eaf05afae67ab7ddb692e79f1bad5871d9c5a270", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147480, "uuid": "88295cac-3b38-4f75-acb6-a11ceaae5da6", "comment": "Malware payload", "value": "63adeff9ccd3e01877a2974e0dc2ae844d2ccdb604630c5857151998c5f5daf615f80e282d4bf45e8761ef6c4636eb3c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147480, "uuid": "fab98c65-c0d3-4aac-9e39-08ada126e74c", "value": "T1AFC29E61BEA4E0786BCF730B76F4F89648387B72909D690C61DE818617DCBE0E53C1A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147480, "uuid": "8ae55967-3c9e-4834-bcc5-20cf7962fc00", "value": "384:J3CUfY2QoZPcwldHcV/aqgQHBXFQW3iAXuCZu64ee/K8OaeMNFhJP:8UfY2ywldHSfgecWxpZu64e2KkeMhJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147480, "uuid": "e86f3ecd-c3d9-4a19-b443-79d4fe04621f", "value": 27193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147480, "uuid": "ebcecdf7-5bf3-4c56-80b0-2dec9359871f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147480, "uuid": "a93047f4-88d4-4c51-97f9-cb776e0d9736", "value": "form_59665.pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1900c3bc-37d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776154099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154099, "uuid": "c5cffa4b-f655-43d4-a1e6-6f0c67a242a3", "comment": "Malware payload (Vidar)", "value": "9d699528cfa5a619c4b2f140b5b4ff35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154099, "uuid": "53cb1fb9-ca06-413d-8468-24a5fd9e93e9", "comment": "Malware payload (Vidar)", "value": "6bfb75b0f69099db4778abbdad7bb65f3661d2d23cba6552cced9002f1440ae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154099, "uuid": "e8e6cfd9-ce67-4ab8-a046-77b04b17a313", "comment": "Malware payload (Vidar)", "value": "b94c486ef64c9d4cb0ccf43005b9e78459667421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776154099, "uuid": "7e481981-3b8b-439a-b2fc-31af49fe3197", "comment": "Malware payload (Vidar)", "value": "5470d8f3e589443ac0e146ebcba242845bccc9a7be436e66368d82f64e5e3f9f1584c6bb56ee96d94e030b5c47b6e432", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154099, "uuid": "6542dbf1-27c6-41a3-aa0a-e16f401d67ab", "value": "T189C59E1F6C9545FAC4AA973188B712957B74B8090B3233DB2E917EB82F767E02E35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154099, "uuid": "33c1cef0-3b0d-4362-9156-d05afec2f181", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154099, "uuid": "0615921b-0990-4549-8a4f-f3d04cedf372", "value": "24576:BBQRCVkto+xl4f3USJCZ6MXCi6CpBzFpD+3fJXv9NoZJsaascoFhheleh29mhPXn:B+RYV2Y3UZgMy1AXIC7sZsc7svn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776154099, "uuid": "151b9432-b580-4fd5-b3d4-53828dfe7f71", "value": 2660056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776154099, "uuid": "f47f07f8-0511-4602-87b1-0b258cec8ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776154099, "uuid": "8333ac48-0a2e-4176-9a20-a60d3903c396", "value": "op6_vidar_v3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798896f1-3821-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776185184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185184, "uuid": "644bc9ac-2d65-424d-a624-bceff0c941ae", "comment": "Malware payload (Mirai)", "value": "07ec8472d6cded04e7751881d4437f89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185184, "uuid": "bea9dc80-b9e0-4c55-9e57-3b7a8b9ea063", "comment": "Malware payload (Mirai)", "value": "6d8cbc0e492b78fb432eea727241fdf1d96402df5303027c502f400f88682d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185184, "uuid": "810ebbb4-eed9-472a-bf51-9613d795ebb2", "comment": "Malware payload (Mirai)", "value": "88cfa5f3be821d42d38e6e3735157f5cc2cce8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185184, "uuid": "0d0cbd89-da0a-4bb9-8f21-5f943c483d44", "comment": "Malware payload (Mirai)", "value": "fa313138a7dccc500b68198d26f9d98d20c9aa5354b6efa2f8da77b3f47efc08d2b42a95a15219f91f10e5a67adc7ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185184, "uuid": "55f3c9fb-c943-4df6-b313-e28c60fea035", "value": "T19473026C1F2E0290CEABD53D63A5678002D847D6A9C78F5F43F57453ECD2B4A2095BE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185184, "uuid": "bb6a2a07-cae2-42ab-b48c-e18d0dc08cd6", "value": "1536:1MTjivWA/pMZwZRGdstsfxyysWBQR1FY0BXsI8CHp6hmg/UZW5yfEPNJ9X37VJuW:iT8WA/p9Zwds6JcOjCJPg/YW5yQ7VQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185184, "uuid": "f9b6f831-ceba-4c8b-8d13-752a54e1139f", "value": 75092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185184, "uuid": "344d92c6-831f-4612-87bc-18ee4f2271ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185184, "uuid": "d5d80162-9ec2-46d4-8f59-a5297dcfc63d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa60550-37ef-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776163738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163738, "uuid": "a870dafa-92cb-454e-89cd-0156b59b9e6b", "comment": "Malware payload (PureHVNC)", "value": "177092505f77f393635c981aab77c698", "object_relation": "md5", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163738, "uuid": "5d7daaca-6645-49d5-9c63-579f492573a9", "comment": "Malware payload (PureHVNC)", "value": "6de54239cd7ad40d70fd59ed5a0c2cf36e2aa9102e47e1c92b5db3e408cce49e", "object_relation": "sha256", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163738, "uuid": "16a19e4f-6e75-42f3-b47d-810f69c92827", "comment": "Malware payload (PureHVNC)", "value": "7c45d3703c17153c3f920d32af5e9ce0664364b0", "object_relation": "sha1", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163738, "uuid": "a64a570e-4dae-4700-838e-4a6762641960", "comment": "Malware payload (PureHVNC)", "value": "b38d17ee7085bf49081d9c47e3a906efb9b9b18db51a4f7ede61eee6e131d96bb738d921375180cda293f3a1db1569ea", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163738, "uuid": "e3beacb6-87ca-4591-8569-4f47a336918a", "value": "T13A053B43B3919E52E15D5776D2F7080083F2EA463623E74F3E8523692D423EE9E462DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163738, "uuid": "a42ee5aa-ab49-4c74-b80a-e46ba56767f8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163738, "uuid": "1624ec06-b468-440b-8e2a-29ca4754cac1", "value": "24576:LrPlSOf5tKF8Ee7hau19/1CUomHQh2bC4v5481:LFau19/1CUDvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163738, "uuid": "429a4d0d-e37a-428c-a3b5-b6a99fde7d41", "value": 854016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163738, "uuid": "349f9963-85a1-4abe-8f0d-7d5251a0e6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163738, "uuid": "29730b57-e2c7-410b-8d76-c6f4d9b0e04f", "value": "PluginRemoteDesktop.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2365f3b-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144558, "uuid": "cee1b457-32de-4314-aa97-66d28156f73c", "comment": "Malware payload (Mirai)", "value": "a6d9b7e3cfc4846ce2cd8fbbb146ebf5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144558, "uuid": "0606b28c-796f-48f7-87e6-0044d102f9e8", "comment": "Malware payload (Mirai)", "value": "6e1bef5d98110f9c896fe1f55d026df120840c2d4bdcab7ea5b62439cdc392b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144558, "uuid": "76683887-16ac-4409-9732-2685571918bb", "comment": "Malware payload (Mirai)", "value": "c73858ef56de09be674e953ccb5a189aa0ea3874", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144558, "uuid": "ef1c03fe-bf15-4c13-9ac2-e16cbfc3b34b", "comment": "Malware payload (Mirai)", "value": "0b2ecc497ef15560e54f7e3c2a763ff6d6dcfc59eb47db63ab533434d70f5c3e762cd7a831e9084ff2443bbba73482a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144558, "uuid": "58e43402-6474-4b42-9584-ee38b477a32d", "value": "T1D26329C1F94B80F1D82B497041A3FB3FDA31DC354061CA2EDF9AAF36EA27541961629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144558, "uuid": "513827d9-b39b-490e-976c-c89c13468106", "value": "1536:z+IoHnkjVqvWnL8T0RGSndqXhu5KWxKfPwvVgIvujETZZV3:hoHkWQ8T0RGSndqXhQwfKVgIGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144558, "uuid": "42e70ed2-4604-4f9a-accc-26295ce4bef9", "value": 71472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144558, "uuid": "c95881f5-b60d-4aae-af72-8c9eafbbb3e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144558, "uuid": "ec081199-4fc2-43b4-9e0e-8ef9be02fd5d", "value": "isex86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed49c494-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144576, "uuid": "48bb777e-a1e5-41cc-b3c5-1688767c13c7", "comment": "Malware payload (Mirai)", "value": "b57a1fb1736c07debdd9464115b61171", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144576, "uuid": "50f34b4b-1c36-448f-ba46-2da65a0127e8", "comment": "Malware payload (Mirai)", "value": "6fcc12b1835758a424fbeac38ac866edba35f5a86ca3c0fb0232750bf4fb6716", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144576, "uuid": "1b805493-e8d2-498a-a2f7-b645efe018f2", "comment": "Malware payload (Mirai)", "value": "9eb042e6982b1850808389802457fc570370e820", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144576, "uuid": "0e2de035-5575-420e-8730-249e8c8347b6", "comment": "Malware payload (Mirai)", "value": "870d3eef51b704e8be680746e27cb547c1fcc26600297bd2d311657fc1b72ffb16d1e0535293efc9af6b34a213d89ff0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144576, "uuid": "c623184a-1778-4af0-bef7-8f16891f7f7c", "value": "T1DF133A91BC925A2BC6D027BFB96F458D332967E4C2CB7727C9151B10378261F0EABB41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144576, "uuid": "589132ef-a26b-4224-808e-153859cbb63a", "value": "768:zWmXMdqqAiqovzF90jFdxJrqER6X/QBiczibWUA21uzJj4p7QDCUFC:wTAczF90IPQBiIibWUA21uzSp7Q30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144576, "uuid": "f46bd447-d369-407d-9cb7-11f583072763", "value": 45556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144576, "uuid": "6dd73469-2c38-45c7-a6c2-f8b084170daa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144576, "uuid": "bc6f148a-3b0f-422b-af4e-c80671eaac30", "value": "kkk.arm5k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786f9fb1-37e3-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776158554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158554, "uuid": "1c59e39c-4b8e-469c-8787-79c3d8bcbe83", "comment": "Malware payload (RemcosRAT)", "value": "cfc6fc42ea51bed0e5f4e72bac7d3403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158554, "uuid": "493d6607-046c-434c-8ea9-c751e4752391", "comment": "Malware payload (RemcosRAT)", "value": "71378f155d0372c15911756feaf6b61c3ab0725bbc67155967caeddad949ba84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158554, "uuid": "c93c5e84-4c84-4761-9da9-6b75f1db0611", "comment": "Malware payload (RemcosRAT)", "value": "00365405282ebaace4d77e3e73c1859296cc7711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158554, "uuid": "84031317-2ec6-4c09-a75b-a553511c473a", "comment": "Malware payload (RemcosRAT)", "value": "48654786404ae47305499b9414518e614414d7e41db7d305a3ea290e1a1f58ec4502746f86fdfb24ee63d1616be1dca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158554, "uuid": "e4aae8b6-bfd1-42d3-9fdc-8905e21d47d7", "value": "T1B93523BB71E6CDADD9224E72C8B228FB56A34E20D9D602131389BF1E79315C24707D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158554, "uuid": "08aed738-4af4-47ae-b4ee-0a51aed09c11", "value": "e2f3f8ec66b7e1900c37978aca89d3c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158554, "uuid": "69ecc346-540e-418d-b144-44efc2323cc4", "value": "24576:twRhlRsO4PUzHonsQje5FW7tCooWMe/iLL8oMOr:mP8Hn5jEFotvoWMTL82r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158554, "uuid": "00e0d773-7bd4-4a73-8080-5c11f9d962a6", "value": 1163910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158554, "uuid": "df6f9aab-83e2-4412-bac2-ae32a91df39f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158554, "uuid": "00f35d22-b9e5-4f7a-a843-b7eac0ff7eac", "value": "Bestellung 240216252.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc9dbce-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776152577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152577, "uuid": "39d8186c-a019-4ec6-8efc-0c1e4394af91", "comment": "Malware payload (njrat)", "value": "3978dfe03aed3a7f6d27d953640353a2", "object_relation": "md5", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152577, "uuid": "af42c533-ee01-492e-81fa-78196ac10a7b", "comment": "Malware payload (njrat)", "value": "72db8824f27f4500fc0e293fbf0892558a62805924364d1e31fa398d90ff94c4", "object_relation": "sha256", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152577, "uuid": "91c72cf3-d2fc-4baa-9990-c113e46e163c", "comment": "Malware payload (njrat)", "value": "8b152f880351d8a78e7bd7d63c14482f34b23e2f", "object_relation": "sha1", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152577, "uuid": "96040fe4-7d8a-4ca0-acec-11f9a70cbc55", "comment": "Malware payload (njrat)", "value": "726f2c9c0f48b03f676fc1bec5b0f373e37b11b7d77ee90b1b7bdc19060936dd3e6e94c90e292aab06612c6b7d721f53", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152577, "uuid": "f108ffc5-6803-4839-a08d-8c04b6e77e6d", "value": "T185E423E215E3665F8046CEBF0CDA505EDB0E1CE69249491B4261F3683A7FE253F31A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152577, "uuid": "a1c9703b-0b29-4c65-b3ec-6ff95b149629", "value": "12288:Z3InVCvVkNAq8n6U/kf4GvzNGnTOyLWByFZZt2wmb7EcgW3pDT7xWLH8MfHDzxo:ZYcdYqkg0qyGWByFrBSA89Tlu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152577, "uuid": "e40152b7-507f-4a4a-916c-0f599ddd70f4", "value": 688436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152577, "uuid": "e4b4c14c-fd88-4536-9279-d67029a6db83", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152577, "uuid": "03d59877-b83f-40eb-bd5b-e9729eec6328", "value": "RickOwens-main(2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5e8bca-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776147930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147930, "uuid": "31e513d0-5083-4e4e-8fa9-c20d8f04dff1", "comment": "Malware payload (RemcosRAT)", "value": "542b4c351706736f4aeb041e92d0e375", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147930, "uuid": "f1994c27-dcca-41e5-8bdf-6ab9d1aded82", "comment": "Malware payload (RemcosRAT)", "value": "73557dc8233fcda24372d21242f53d9219cc3a608df731653e2145f8dbf6d11b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147930, "uuid": "5a2cb3df-41c9-4355-840b-9a5e67b33d56", "comment": "Malware payload (RemcosRAT)", "value": "c550704ef7512679829dd8f07f6c07758502e6b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147930, "uuid": "9765b24a-3fa4-4aa4-90bf-bb36670b381f", "comment": "Malware payload (RemcosRAT)", "value": "a7cfabe747bade453b8f1ed9d6bd28e7652d034004983ecff0e7a9cf2de0dda594fdae034d7827ea6a426b628fcc41b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147930, "uuid": "8299aade-1e2a-4fd8-b054-cc08e0053688", "value": "T188F22E501F0BBA06D17B0C8E78BBF5CB617512BD0A009A6961FD368AC61378D6CDB87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147930, "uuid": "6884dc45-0bfe-465d-a06f-9f97ce20b34d", "value": "384:AHSup/9Ktto+TgE8ZZWdc442gYXt2ImugY6ngvNc0mdPZxBI0ZGB0eyTA+/WY:4SEbZs8TATIGKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147930, "uuid": "e09b2c20-9328-4040-b76e-370ad1b20b75", "value": 36160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147930, "uuid": "5041583f-41f0-4c5b-88ec-a3bece2dac51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147930, "uuid": "8665f397-1c1a-4c30-a2f1-73cbe505f3bd", "value": "goodforbestthings.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75c8121-380f-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1776177665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177665, "uuid": "bbda5d9b-0de9-44ad-8962-430a645c6202", "comment": "Malware payload (RustyStealer)", "value": "f0bc2d9c9e262f0c0811b923983e11cc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177665, "uuid": "a3158c01-a60e-46d8-8982-1bcd5623406f", "comment": "Malware payload (RustyStealer)", "value": "748e0ea3a65fd65fd0b58c74f7466aba669656e158685c6b660a941976b5682f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177665, "uuid": "8081a621-60d7-4ef9-bda6-69f17bbdd753", "comment": "Malware payload (RustyStealer)", "value": "b07a3ebad5c317ecb4efa770c80b32c5017f210c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177665, "uuid": "eb62c318-e1f7-4247-815c-20dc8fc91a7c", "comment": "Malware payload (RustyStealer)", "value": "b179c375e2994b8ba49733a7272746d924f9a8097edd32f485b30215bca28cfe3a36d0c9db107cf92bace7677968a0f4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177665, "uuid": "60ce84b0-13a8-4120-8ca5-1f9f987aad8e", "value": "T1E9856B03F69881ECC4AEC47887669636EA72B88D0630B2EF1BD41E553F26F906F1D355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177665, "uuid": "97568558-3a3b-4de3-87e8-ca6df5c278c5", "value": "1cc8077bb1aa2410679b2bfbfe5a8639", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177665, "uuid": "a9d5adad-90b4-4618-bc26-3e43b369a05c", "value": "24576:YYUWzyova24x4WuZkK9zXvltMbAIRZH9lfQqCbqrdYA9YM7Wr:YYf2ovapxIZV9zXvTKDZdlf2A9Ybr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776177665, "uuid": "573a863f-f655-4851-bfbc-0efe1295d69c", "value": 1763328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776177665, "uuid": "5e3921f1-1d34-4ac9-933f-c3145573fb2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177665, "uuid": "e575a480-49ff-4850-a254-639a5d7b72af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492ea76c-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147737, "uuid": "279a1313-903d-4a00-bac5-d809781287c3", "comment": "Malware payload", "value": "9d75b97ef8de970b45915ff65f808133", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147737, "uuid": "ef46d35c-4d3e-4f83-a59e-b5d814793b80", "comment": "Malware payload", "value": "75d68e9aa925a46a11ae4e9cbc4461f6dffefcee8d439ce25ec0e7fb5f5f280e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147737, "uuid": "1469d76f-952a-41d9-aa98-11efa56a2626", "comment": "Malware payload", "value": "2f396cb3b749fae9da06afd72ae8aa4cb5fc0462", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147737, "uuid": "e4dfce40-2f8d-4cea-a9b8-16ce043bd011", "comment": "Malware payload", "value": "a84bb0f7a32129ef908839dae7e9ff737a030fa1d2320f8bedfb40fecb04e26240e702e23ac4230da17d6b356e58db50", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147737, "uuid": "04a8ec1a-2855-4e63-8325-7eb4860c3653", "value": "T1329602FF1FE91B90C1292DBED01A49EBDEAC94988DC34E8F118054C459B1E1D3B45FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147737, "uuid": "67e23538-98aa-488d-8f8b-2221e150e03c", "value": "25f4c5128b22a67669b22be9410df358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147737, "uuid": "537881f0-2282-4b40-8052-083c92a9c3d3", "value": "98304:dw2h+x47FjIue3cPpNi4QvIEgQw2h+x47FjIue3cPpNi4QvIEr:dyKtIu7PpE4QyQyKtIu7PpE4QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147737, "uuid": "8c4a308e-a351-42a9-8794-0e44d8631dd7", "value": 9240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147737, "uuid": "a00129cc-3f61-4f87-8bca-53570017b62c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147737, "uuid": "35e47548-7a79-4526-8710-cb73c659b0a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24738f0b-381f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776184183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184183, "uuid": "228f53bd-33aa-496c-b5e7-57eaf6f7297d", "comment": "Malware payload (Vidar)", "value": "f7e02737951d2f70243ea7fe00260f36", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184183, "uuid": "04abd06b-0723-4aba-80e7-183de313e4e4", "comment": "Malware payload (Vidar)", "value": "75d8b1634e25e24e7aab3c6b5b084cbe102e2818da122dbaa717de1d0e05ca17", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184183, "uuid": "e6e463ae-f372-463e-83cb-7e59e0dc3fec", "comment": "Malware payload (Vidar)", "value": "3de4100b366fbe8a2222da415c71888f454c9902", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184183, "uuid": "b6f5c5bc-7cb2-429c-bf21-6123c06a5feb", "comment": "Malware payload (Vidar)", "value": "3ec160e5eaa8e5e95d235085fe1ec789e159ea7a8a71bab5414537bf5c29c39902d2d950ec6c0bc2c727d61c3bb25bc4", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184183, "uuid": "7df17430-2728-4a75-96f3-da7ff6870d5e", "value": "T1CEC58D0B6C9509FBC0AAA7318CF65192BB70B8090B3233D72E9176782F767D05E79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184183, "uuid": "c86eeb0b-1c69-4254-a48e-0871c338c20b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184183, "uuid": "25814038-c1ef-434a-b003-401599b4f6a0", "value": "24576:1FWW/Yfiqmqsny5dJn7DDUlJYDo2/Z2/OkJ73fsmHEtH6HPOzheleh2Km+UU9frF:1FWKyiqIny5dN7XUlSYOkJ7fsCAPzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184183, "uuid": "0b3864b2-827b-413f-a088-90f63ab7d0e0", "value": 2603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184183, "uuid": "b131167c-7074-4ab9-ac1b-988c583ef62e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184183, "uuid": "69c466a3-e38d-44a6-be16-9a10145d21f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3d1f2-37e0-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776157217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157217, "uuid": "94231768-ab7d-4a94-855a-6ecb775b3dcf", "comment": "Malware payload (AgentTesla)", "value": "c6579436299cd3811173374f5799a1a6", "object_relation": "md5", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157217, "uuid": "6654b0d3-b3a1-4da3-840c-95f4616035aa", "comment": "Malware payload (AgentTesla)", "value": "77391131a0a0da51d57513444b2c635746df2e28bbe6c64991041427c856772e", "object_relation": "sha256", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157217, "uuid": "d1c1a3e8-c4ae-4c7d-b612-d17fce67adea", "comment": "Malware payload (AgentTesla)", "value": "20d800f25e2f62c83735a980f5549d56f8498acb", "object_relation": "sha1", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157217, "uuid": "2e8280e5-6c07-44ef-8b81-f3fa1af3c538", "comment": "Malware payload (AgentTesla)", "value": "3f56e71066e652b8dbd7ad139d4d15ec1cd24209283165bb23d5893deaf88a95ea759c8b582e65ad1c27e9c8321a721f", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157217, "uuid": "13b121e0-cd82-4f19-835a-91e6a6654e89", "value": "T142D423017924C453F3322AF1DC6A8F726AE87C64F6518A5F2BC03E4F7DA7951780EA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157217, "uuid": "0b35b5ee-10b3-4941-b3b3-b4c640de2e1a", "value": "12288:eX4jwQ0CnmQC9Qf4Ct8v5kFoTNdvR0t1DVP8EAl4soOBRvAnBs97gTd2h5YwvDls:g4jwQPR2kSvtZstN2NBRvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157217, "uuid": "596251cc-34ab-462f-8111-5f3d857f6a37", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157217, "uuid": "af0305a8-64e7-465d-ad0d-524adf8ff816", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157217, "uuid": "bfb8d8fb-73ba-4a17-9f42-1d3a9612e143", "value": "nCopiaDelPagamento14042026.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c49556e6-37d1-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776150951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150951, "uuid": "2e008a9b-16a2-4141-9f72-fa769ac31b1f", "comment": "Malware payload (RemcosRAT)", "value": "5153ef969156e36db29829a3718d9df5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150951, "uuid": "f9384668-138d-4370-9ee0-bae2c3af264b", "comment": "Malware payload (RemcosRAT)", "value": "78ce16d28d23b47057cb1f978f00cbd75833d90d9fbab9e5c0c2f102854844a4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150951, "uuid": "a7ced574-a782-4ebe-9c68-65836c9cf6b2", "comment": "Malware payload (RemcosRAT)", "value": "767cf3182e2dfe22e3db349d5ac7eaac01183db2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776150951, "uuid": "f0e05fb9-2716-46ea-bfae-434fdda5504f", "comment": "Malware payload (RemcosRAT)", "value": "dd776a95327f384d57519895a11e940d63f1687c88170558b48c6a96c912ad0f98f6b3604f8b8c6d49354466a4c84c59", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150951, "uuid": "c371bab8-e8ad-4a3b-98b9-c7e83c470057", "value": "T168E40179F64D84DCC603C479A6968981571DBC646F6A9B22309FB32BB433ABCC7C3512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150951, "uuid": "d4ac055e-6b52-4428-b8ac-20d82973b529", "value": "12288:rbpuYhTIj3OpuYhTIj3fqtI3kvT8ZrlgL:JuYhT7uYhT4UvgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776150951, "uuid": "fa4e45f5-23c0-4ef3-a6f4-18e3b0037aa8", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776150951, "uuid": "53c68780-ea1e-4a31-a6db-5e6242034416", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776150951, "uuid": "a6067a35-18c3-44bf-89e5-5ca35b692914", "value": "Sat\u0131nalma Sipari\u015fi ECMF060181.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b86d8ca-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130695, "uuid": "d8add24b-9845-4dce-ab4b-6f9d26bd8b98", "comment": "Malware payload (Mirai)", "value": "a85bdb051023e76dbf3e484cbe2c2837", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130695, "uuid": "8712aaa8-0ed6-4898-83fe-569a1430c94d", "comment": "Malware payload (Mirai)", "value": "78eeed83d81521f15bfe3f2c29666f4125d578dc3d8641891562d7da56c1be27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130695, "uuid": "a400c317-4e69-44bc-afec-81949871b454", "comment": "Malware payload (Mirai)", "value": "a6a84d8a08f07e92c5082656c413f5fc463eb4c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130695, "uuid": "c1b0487d-6d35-483d-942b-2845bdd85ceb", "comment": "Malware payload (Mirai)", "value": "d2b9b2c6f535e05767d117562e01c4bd0d66f6a9b8aeaebd242603b469488bd4de9b2975b969857c76ae63b33f8c3d7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130695, "uuid": "15fb764e-62fb-4d56-be06-31aef9adb16e", "value": "T14C1318DBB4099D7CF81FEBBE95134909F631375550830B2667ABFCA36C321649D22E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130695, "uuid": "9cbb6d4c-af5f-401d-9e9b-d1fbe42cb44a", "value": "768:dje7hoVSUB/N6a57SNCn7zV7GPhJEeFUw9mriwU8v8F:JqeAcYjN27zdGzEeFUw8rid8UF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130695, "uuid": "90b2bcab-f33d-47d6-8d9d-234ae3f6b218", "value": 43604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130695, "uuid": "7ebfd4fe-c87a-4516-b110-3c2ce73988c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130695, "uuid": "e38ac039-2ffc-4ef2-aa36-c0f9c5f9e042", "value": "0upm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a6a4f0-37ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776162811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162811, "uuid": "429a4ced-883f-450b-b388-51dd51b7f9b9", "comment": "Malware payload", "value": "d89fdfb94f635684b9b7e566c0e91f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162811, "uuid": "65b7215f-55c5-4222-862f-4ca6bf2a837f", "comment": "Malware payload", "value": "79c1c279dbd3d4963f863daabe295cce62553af0d3e3b9224f0ff62fea1b92eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162811, "uuid": "9b2b07c9-9016-4d6c-be53-5595ff6703e5", "comment": "Malware payload", "value": "19bf0d41ee38b2b20cc776c507f2d95b3e02b90c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162811, "uuid": "5e380091-a1b7-4740-b05c-f3f437546cc2", "comment": "Malware payload", "value": "82b1b0e8092b6f5d2366bc2cf2fd75153b7bdb49c5460cfc8909e9f1e102d18dbe590b53f9f45aeaf1bd6d53b36fd530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162811, "uuid": "b7eb0cd7-03f6-445b-b5be-d4c3b5dfe764", "value": "T13E083382FF0B0C7DF6E9E570BB5815B96D92ECB082D554315DAC38AA78309E548F903E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162811, "uuid": "6912fb46-7451-4caa-a178-812963ae4a1e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162811, "uuid": "d5be84cb-5723-4dbe-bfa2-fec89b3ea2f8", "value": "1572864:pLdkrUQy7M9KAsud/OfIVi4B09sGtWTL0Q20Cb4IHpwVaGAoUBbQ7:p2raMwQ/0UfetW3W0k4IHpoaKwbQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162811, "uuid": "f831881d-7813-4e6f-ae14-4bc91711480f", "value": 82692203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162811, "uuid": "cb36a6c6-d0e2-4b6b-99a8-9827627721c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162811, "uuid": "90bd3e42-2b1c-41e0-9933-30e52938051e", "value": "stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3d50d2-3836-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776194369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194369, "uuid": "efa8e6b2-33c2-4c29-a13d-a4f024a9f905", "comment": "Malware payload (ConnectWise)", "value": "752a7188f2bab1926a63254e29f3108a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194369, "uuid": "a33b2e99-1242-405b-97cc-cd6645310bb1", "comment": "Malware payload (ConnectWise)", "value": "7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194369, "uuid": "fbdb6660-f167-4af4-a3bf-182f563170e8", "comment": "Malware payload (ConnectWise)", "value": "3cf97b5207e51a1ae8e640450279abef204f0466", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194369, "uuid": "0c1a279c-95a1-4f7c-b397-2df0ff10ac98", "comment": "Malware payload (ConnectWise)", "value": "40a03471179e748dbcd72db6874e5abdd194546cbf533930a3f567cdb6f41b4c34df1a41ef2a0a1412d54fc1c2458ba9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194369, "uuid": "1d75b906-74d8-4259-b836-3a7f921f2947", "value": "T1C08533F7AEA65EFA183DC41CE60789812013376EED92FC43A971541116F8B925BFB2C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194369, "uuid": "14446e52-c72a-4f61-9b3a-6ce9d2e95198", "value": "49152:xVN9Mu/qTBHt+CBJqbe9BkitnoDfqfTurHUezJ/T:xVI+uBHtFqbUkiNWfCTo0ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776194369, "uuid": "654880aa-b925-4f8c-abd8-972aa817da71", "value": 1801298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776194369, "uuid": "f1466335-37a4-4a42-9aaa-1b02ccdd9a47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194369, "uuid": "aec96300-a17d-4ee7-95be-aef3d310f74c", "value": "OneDriveServer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b8417c-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776165025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165025, "uuid": "66efb1b7-6f00-497d-9003-e4c7df24db06", "comment": "Malware payload", "value": "ae8c057599c6805c8f16683bf9ef3d94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165025, "uuid": "0dbfc328-1e74-4f15-b13c-435be5207822", "comment": "Malware payload", "value": "7c0cd1ea9976c11af415677f9eed937f0a744784266eca7f635e2ffb22d90251", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165025, "uuid": "11f426ee-d8d0-4c3c-a34c-e39994f501c7", "comment": "Malware payload", "value": "0cf7ff8227c00b56e8781905fb7bddfcee9f6876", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165025, "uuid": "4f8fdb06-5e92-4573-801f-e5886d3c57a3", "comment": "Malware payload", "value": "3f625e1d87b0e197d9b38eff5b7c79d1fe970d4eadfb1c036546e485428369a021380782f2ec658dca7345e9094185e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165025, "uuid": "c55e4050-1d23-46de-8b72-b90fab8f9b6d", "value": "T1A5542E38ADEA401AB173EE14AED43497E96FB773370E589D10C10386472394AEDD963E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165025, "uuid": "5d66cfc7-de89-4c6f-aa40-31729212f489", "value": "6144:mdA9UD7cagvI2232xsPVPzZo2JQBcA5T4eM7vjMG8T3CzmibL/2:dUDpf5G2PVS22mqhooB0mibj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165025, "uuid": "a94d8de0-5277-4052-bead-7e29d3f26563", "value": 306084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165025, "uuid": "ba8d6ed4-7cac-4d7d-891a-d81ff7b0c39b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165025, "uuid": "0b053d61-b0f7-41c3-958f-39cc1f78d503", "value": "Gemini Order No.2026-037.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe34330d-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149759, "uuid": "850eeec1-8df8-41c3-9f94-d48c34173f86", "comment": "Malware payload", "value": "ef8c6109a4dfdb95539cde030bde3cee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149759, "uuid": "335fc8af-43c4-48ae-9740-179286598173", "comment": "Malware payload", "value": "7c5dfe36ffb0d43d6c7da10663c10a8a3d147be23b39d499fc969c495f1cd371", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149759, "uuid": "3174343e-bba4-449a-bcc9-552e929c2cfe", "comment": "Malware payload", "value": "95b2f6aea33220592bf0d58382552ae60cde3080", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149759, "uuid": "73ad0f15-551c-4b1f-8216-5ff997647567", "comment": "Malware payload", "value": "c503c31a79b974e93f55f74bf14ba95ac71c5effd86b4866b66e1a3c55e1a8f2bd8cce42a5abbe3b7c42225fe5063a74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149759, "uuid": "8350ea51-4763-4279-8b2e-772a9091b31a", "value": "T1D8A42E38A9FA101AB173EF54AEE47493E92FB773370E585D1081038A4723946EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149759, "uuid": "f610b1eb-f46f-4bea-a70a-d24bd3b7638c", "value": "12288:GJZ34Bwrt8gJXHEav0J6950Dno0PYIC+JFHrLuTf:Etc3HI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149759, "uuid": "58ee3dbb-3964-4d87-a113-74f01203fe4d", "value": 458948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149759, "uuid": "a6c14966-2d51-472e-bbae-cc201419c28d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149759, "uuid": "e10c36f3-6d7c-4a2a-a351-782651e0c288", "value": "RFQ#W40.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1a7e2b-3809-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776174825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174825, "uuid": "a3171c40-4707-4030-962c-766e5791c474", "comment": "Malware payload (Stealc)", "value": "3d8e835acdb341767449ceff50de9785", "object_relation": "md5", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174825, "uuid": "2fb80868-9d72-4a96-b65e-87f3ce5be71f", "comment": "Malware payload (Stealc)", "value": "7d3442ea825ef12fec37ce5f2fa386c148780aa1288c42cae408449f0dd573d0", "object_relation": "sha256", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174825, "uuid": "f7ad0384-aaf7-4566-906b-c33dc2cbe7b1", "comment": "Malware payload (Stealc)", "value": "04820db74b30261b6c5a97c5219b4fec1a6f59ad", "object_relation": "sha1", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174825, "uuid": "c49ef821-2850-4178-9730-7b346f05a12b", "comment": "Malware payload (Stealc)", "value": "f9d3a4a26abea3956014947ce3062ca10db1ae00cac73834e06d1836c001feb25d3c9549ef321c32127093a32d869bde", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174825, "uuid": "aef907c9-f5d7-48db-a794-56282c27b58e", "value": "T161E733D7E6158314C1030A75AFF3B68C7398AFE4C6A281B3189CBD5DF41D662188A67F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174825, "uuid": "bdf45061-ef4c-4fc0-9da4-d671c4477456", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174825, "uuid": "05b25a7d-3cd0-4efa-9dbf-2355d6bc1424", "value": "1572864:CLdkJWiNGUfvL14kmbNHRh34AGXbgWbKLJvGs9lfa:C2JJG8v54hXh34hXqws9lfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174825, "uuid": "d8056062-4521-44a0-806c-ef347cbbc627", "value": 67475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174825, "uuid": "789459bd-6094-4bfb-872b-37b43456bcb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174825, "uuid": "605dec3c-e008-42ce-b0d7-8bedefed9cd4", "value": "GitProject.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b569f93-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776191066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191066, "uuid": "03dcd58c-4557-41d3-bcf1-6e354d696da8", "comment": "Malware payload (SnappyClient)", "value": "2a8acb83964b9a298dcc1504369218ff", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191066, "uuid": "a58a4037-4a20-4644-a49f-d7a3f2142272", "comment": "Malware payload (SnappyClient)", "value": "816b19b761d9cfd64934895ece780e1ad6602d3245b6cc9526094506680f30c8", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191066, "uuid": "ad3a2c5e-08d1-4749-9321-ea646fd7493f", "comment": "Malware payload (SnappyClient)", "value": "f1a5f659586ff36d6ca2b681f40fbd85f4c09fb7", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191066, "uuid": "8097ee20-b2ae-499e-89d4-d8a5d0deb66c", "comment": "Malware payload (SnappyClient)", "value": "2a9dbe827d2e4904a79df27ff08f98a57d12de5101ae84a7f251b9367e03adac0df8d11d352746e6d1288fc286937416", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191066, "uuid": "533fa961-5d55-4cc5-8b88-b47e28563379", "value": "T153653342DAC0C8A5F23865B8CED7D5AA9685B7FCB3C521D78D2AE8D35B5ECA05030C47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191066, "uuid": "9ea25411-ae4c-4240-9113-6eb992875244", "value": "24576:EJKNXncM5r7XAQamxaNFN+4dO1pGp0cqD7JV3N26MOT:yWjdDemxCS1ouD7Jb28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191066, "uuid": "7cc87e56-4ad0-4d18-9b0f-9cf9c77c62a4", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191066, "uuid": "84a1e906-65b4-4139-b461-463af9727d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191066, "uuid": "5941a7e4-b334-4295-ae7f-2b5f3814e381", "value": "816b19b761d9cfd64934895ece780e1ad6602d3245b6cc9526094506680f30c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a7dd98-3816-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776180403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180403, "uuid": "e14bdf27-c36f-417d-a0ea-1b82a783a722", "comment": "Malware payload (Smoke Loader)", "value": "c9190fff6697d1e22c3afadad696a4ec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180403, "uuid": "d3c1d9de-a24a-4174-9e2e-8a3fbbd2ab12", "comment": "Malware payload (Smoke Loader)", "value": "82cc7a25c9f07df2dbde7dd4d2cecc9d46b3af897df6ecc11c956fe2f038336c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180403, "uuid": "310d0b64-bf8a-4eb0-b33a-dcff359cf390", "comment": "Malware payload (Smoke Loader)", "value": "93d275e4e41c67291f7a48e283512f789fd39b83", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180403, "uuid": "f6798d80-da69-42bc-b6db-d29798a7440e", "comment": "Malware payload (Smoke Loader)", "value": "56588ab77a3ff1cf9ab2938b9d867bb04eeb63e712e59be388e660a817c7278e36c1a0bc8ad3e48057bda3a89697e81b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "G", "colour": "#9D82E5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "US.file", "colour": "#F8C06B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180403, "uuid": "2df71054-0f8f-4b46-89cf-8ac0315d16df", "value": "T114A57C0B6C9545FBC4AA97358CB616917B70F8080B3237E72E90B6782FB67E05E78714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180403, "uuid": "84cf505f-c4a1-40ee-a3d2-b5fa249f60fd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180403, "uuid": "c030da93-04ac-419d-b8e3-4dde1e617469", "value": "24576:K34/bUnJDA4N/QHgEA2imboSqo5yCk4wagWpI9cFtIOhheleh2KmyVLTO5Tb:K34jwJFN/QrA2zoSo9kmIFOTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776180403, "uuid": "4f32c1ac-56b4-4bdb-b6c0-b9f1a1b00707", "value": 2167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776180403, "uuid": "29cde286-1964-4b3e-b0df-8606f6341a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180403, "uuid": "129da7ad-7be5-4cbe-8b38-a6260a364815", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3e05c2-37ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776163370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163370, "uuid": "11735d95-b77b-4936-92ba-e27755aa4f9c", "comment": "Malware payload", "value": "a1cee516736d36dd318f7b1b1436187e", "object_relation": "md5", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goldeyeuu-io", "colour": "#974D94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163370, "uuid": "412ee4b5-da13-4d78-8f06-8f81a0447bd3", "comment": "Malware payload", "value": "8509af4802dd79fc503c425c9dda035d9b636f22ffac81a8f04e6a9d080fdcc3", "object_relation": "sha256", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goldeyeuu-io", "colour": "#974D94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163370, "uuid": "5b171928-d099-4a55-8bd3-c3f013034d33", "comment": "Malware payload", "value": "f81f5b8733f3097efde5585953dedb3d00da8a10", "object_relation": "sha1", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goldeyeuu-io", "colour": "#974D94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163370, "uuid": "6900f310-c61e-4551-bb7e-85c54a374fd8", "comment": "Malware payload", "value": "50229c2ed31ec524da9a7192ffbe950ad967d4ab17a37e46b16fa31515d85b5fb807bfdd217456d35b79b31a85bc79ae", "object_relation": "sha3-384", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "goldeyeuu-io", "colour": "#974D94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163370, "uuid": "b0fd644a-eddd-42be-9896-b29888478e28", "value": "T1B4648C16B6A510FDED77C57CC9524906EB72BC5747A0E7CB03904AA62F236D08E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163370, "uuid": "97c3ede5-6150-47fa-8c14-d9161a373c12", "value": "831d4d9e9548fd7fff0752e7f15f4e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163370, "uuid": "eb9d5081-73d6-49c0-b66f-58d24f19d3c5", "value": "3072:WQhFL2fYYP8WpwDHFOcEy4WOBYrthZ2WzO1Hn/1XIRshGkMTylDE8jF51X6xUOfJ:WzpwDZEyPiIhkWwHPGzWTOfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163370, "uuid": "401a8413-0e7e-4fb7-af0f-09404d73bd6b", "value": 306784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163370, "uuid": "1224b4d4-fb5d-4586-8da4-22097ca45290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163370, "uuid": "6755a73d-9dfb-44aa-8f3e-d90fdf52115c", "value": "photo202604156896.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd3d2e1-37bd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776142188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776142188, "uuid": "47902b50-30e1-4b1e-b5ac-983856e9e79a", "comment": "Malware payload", "value": "046bb48d58faae04cb5b1980c5735305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776142188, "uuid": "8af8af4e-f606-464b-9ca2-5e32120b8224", "comment": "Malware payload", "value": "85450e1dfbc5c66192d80447310c3d410069a31a7e8cb5203e15af7cd49e6cbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776142188, "uuid": "506159e7-6026-425c-a5db-4dbfc56ce4bf", "comment": "Malware payload", "value": "5d012d0ec428fb64fe55a16cfa92d5844697d226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776142188, "uuid": "64481c16-6103-40f9-b58f-7933c1b9fbd4", "comment": "Malware payload", "value": "a0ec4452a6e397dcbe0bc98441e5d052603b679b9de6c3cab4a7eb007058073e0546b366a55db6c4b3511538bb0c5687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776142188, "uuid": "a7bd4920-a2ec-40e7-84d4-86d1fe59f7ba", "value": "T1B3841A1AE71104E9DC7BD27E849B29E1AB62BB090361C7FF263442155F232D95F39FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776142188, "uuid": "6c30fe39-448c-409a-96e9-e59c515fceb0", "value": "2a57bda42a8f1e6e02d8b86719aca2ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776142188, "uuid": "4f42da8b-b59b-42fb-a087-0f6fc7425c29", "value": "6144:EkJTSYm7dZKwW12G+i5W8ULwrDM0wpGvMdCa6uZPVArDM0wpGvMdCa6uZPs:EETSYm7nKd2G+j8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776142188, "uuid": "7733a33e-80ee-4709-9090-9dfedaf8942e", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776142188, "uuid": "e29b3eda-cc0f-4b5e-b6a7-9b96f8e28a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776142188, "uuid": "11baff8b-25dd-4222-846f-2ca81a11eb5d", "value": "FunnyApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b679101b-37e0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157369, "uuid": "6673ca6b-9186-4c9d-bac8-53b45abf7c9a", "comment": "Malware payload", "value": "5a7488b33be89f6f334a96a1f76acbe4", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157369, "uuid": "103edd6f-471d-4324-8734-0b8ce4e2d109", "comment": "Malware payload", "value": "8635dba2ad8453d5b13dc5c49f6a4121561f7349151b96353bd240f906ff0272", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157369, "uuid": "c7116595-7bba-43bd-87e1-72cb809f77b9", "comment": "Malware payload", "value": "9db9469ec00646f21b6d69e067111304eaebb4cb", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157369, "uuid": "a7b632da-7a69-4b7a-a34c-29cdcbcd4e1b", "comment": "Malware payload", "value": "1bfc98db53703955102386a48d711a10ef43c682b0f796faa45973f0f0924e5940acfb4f2e01d77c57c2c0b15f153984", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157369, "uuid": "d974e945-85b2-40e1-af8b-63d5608e7f93", "value": "T132A15460CDCCFB84A25297449ECBF74B80A43C7E2E318831EE6145065861F7BB79B8D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157369, "uuid": "0c1fdf79-cfd3-453a-a8d3-11e3da03153a", "value": "96:e0rU6bxin2If7L8QmnyTlzektEwf9O3U1UaoOyd+oxs01RO3Q8:BrU6bMj8icktES0evod+Uaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157369, "uuid": "7652d559-aa9f-463f-b452-db59bf8052bc", "value": 4666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157369, "uuid": "64a45321-2262-405a-8010-03f347b136cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157369, "uuid": "f027795f-3b03-495d-912b-cb5f96586150", "value": "payload_1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c667f40-37f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776166291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776166291, "uuid": "ad5fed2d-5da9-4e32-b073-fcc8a724831c", "comment": "Malware payload", "value": "91f402cb72fd8c00dd33d337ae5d4435", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776166291, "uuid": "b3892d80-3803-40ac-9766-e68163452f7e", "comment": "Malware payload", "value": "8724bd044393f274f43d30ffd10d9906a5408d6d62b4f0efaa12f817018f180d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776166291, "uuid": "32335a10-1a3c-42db-955f-31cf1a1d0531", "comment": "Malware payload", "value": "90bacc136dbb1545e2916e09a6086ca8cf2b15d6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776166291, "uuid": "c0c530fe-33c4-4abb-831c-55155c77c195", "comment": "Malware payload", "value": "53ea6bd5b087735dfc64187612bf822049caed0cfe644f4cbd105b2c8e08bda835eabe3805cf069d947573cd2f2eefb7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776166291, "uuid": "08857d40-7b7c-4ae7-a96b-be63567657d7", "value": "T1F5137D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE718B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776166291, "uuid": "f1be7793-a216-499a-9afa-10ea82e3f97f", "value": "768:bds9NyXsZztCV9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:biHusZLcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776166291, "uuid": "f8f5adb8-ac7f-4c59-8c66-c7eb7ccb1073", "value": 45515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776166291, "uuid": "bb469a6f-84fc-494a-bd5f-7e0e94c5a763", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776166291, "uuid": "f9327e86-c7d0-4145-90b5-2633a50e599e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06554b3-37ff-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776170674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170674, "uuid": "cf5d6d3e-2347-4881-b5f9-780bbde7d321", "comment": "Malware payload (PureHVNC)", "value": "58d3f6d657742377b2179467c86f5b0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170674, "uuid": "7b643b9a-9409-4b6f-a0c8-fe7c4506cd4a", "comment": "Malware payload (PureHVNC)", "value": "874cf5b87424dfc81eb08c1878f503c5b1f366703c48820223f3d4ca92fcf257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170674, "uuid": "d3cd5fd6-dad8-43df-9282-b6fd8d326d8e", "comment": "Malware payload (PureHVNC)", "value": "9f1dea2a563edf5235eb6de399dcf5d8e6facb64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170674, "uuid": "7185c5cd-b298-4d9c-857f-a42c9c60d47e", "comment": "Malware payload (PureHVNC)", "value": "69c6b2df6de7df809844a640401b722bed9eea7b6d047faf13ee7ff7193f539979732d1cfd91a793efcb45fd0e610cf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170674, "uuid": "37b97bdb-8f87-402b-89a4-c97bd15b7dbd", "value": "T17B940186B5C29B40D9A54A79C0D3093423E3A4C7BEB3F7993B8046D60E533E8DE9B745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170674, "uuid": "ac5ebaab-3baa-43aa-bb47-19c0cf2ea146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170674, "uuid": "49845aa6-08e8-4b0f-bbdc-0083a26f5e63", "value": "12288:A3QvctGwhKDYWwKo7dZ+Xbad57+ZPMboVl:UQ0v1KO82dN+tWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170674, "uuid": "c6b26544-7618-4972-bd8e-f2154f9b8556", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170674, "uuid": "a950968f-7621-47ba-b3d6-f0487d947ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170674, "uuid": "a9fbd5ef-d2d7-4cf8-a2be-18f9cf59b1d6", "value": "about-texture1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de32bb0f-3809-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776175045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175045, "uuid": "73105a0e-922a-4b3c-9535-c74ee233a51f", "comment": "Malware payload", "value": "8ee1fe2bf0e999eafa96ebaac1d215c3", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175045, "uuid": "dad3facf-8a5e-41cd-a26d-74686861e5ea", "comment": "Malware payload", "value": "884b61a7a214e0c614a3b534d51390f7a493f4bfa176a6dd9e55a029b69e604a", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175045, "uuid": "5b9b0648-fee7-4ead-b746-655aceefa714", "comment": "Malware payload", "value": "e87c5793408f5a0eff5647f0de0a2505eb00aa2c", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175045, "uuid": "fe39b289-9eaf-4107-9929-220a19e80b06", "comment": "Malware payload", "value": "7a75f9f9e9cd2e7267ff40a6a5a7b5af063f0ac19c170ffde2ea52a969d0002dd1ed1575fa270a36f37f79f8c3e5491d", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175045, "uuid": "7d6e2806-22c4-4f07-a4d1-766802a962f8", "value": "T11662752E6D407221B4F2037F68A3D646D8EA11B749095858B5FE02842FF576F8A61ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175045, "uuid": "aeaf7592-1399-4653-9539-2d58b8af28fc", "value": "192:3f8yYynoU0IwWtp1C/++rS34ojVCunN84LVbtjDZ97K02wZUsfJk:3hzBNnXZlh2Vkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175045, "uuid": "4e0631e6-3da5-4097-bb15-9a88f10fa642", "value": 15080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175045, "uuid": "716cc71a-3786-4f6b-975d-466449746450", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175045, "uuid": "3b2ad990-4c6d-4f39-a58a-6e2f52082c9e", "value": "persistence.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f8fc4e-37cf-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1776149772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149772, "uuid": "59155d86-e743-48f4-b2a1-5f7c92615d69", "comment": "Malware payload (SnakeKeylogger)", "value": "a60a3f6bad9446cf2532980280bc8cec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149772, "uuid": "7626f6be-26fe-4530-8edf-d181d0b31db7", "comment": "Malware payload (SnakeKeylogger)", "value": "88d63b0589f9ccb2caec7f55aedd7137a5b25fe010d9318737c6bfe0777ba7bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149772, "uuid": "292e3a88-3cff-4309-8cb2-41facf61b181", "comment": "Malware payload (SnakeKeylogger)", "value": "69b6bfd1bddbf79012681cdaff427767bc3490b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149772, "uuid": "b596bf6e-5e2d-40e0-876e-19abce46a562", "comment": "Malware payload (SnakeKeylogger)", "value": "0e757fb17ee934153d1764d8d35f2328627bb3d17949c7d429e0c4d86980bc8c481b14f442bff7b8a7fafa7dcbd8c500", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149772, "uuid": "b24c63ac-ff2c-4dae-8b19-b3163e2bc445", "value": "T1A115F24555C83FA9CBF8121A40BE260EB3B08D496058A949EF77FD4FFFE7A04512629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149772, "uuid": "ad4e9492-7602-42cb-847e-f9ad6e70e3ce", "value": "12288:jMnwmJCR/smyg+oWn9VeZAU+F4bXA78mRPV1qQwB6MZhTDKJUUE5Nztjh:jMnwmJkknVszA78mb1HwB6MLTHNzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149772, "uuid": "7009c441-7d10-4ac1-b3f9-86cb3c7ef1dd", "value": 929523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149772, "uuid": "076a514c-efdb-4b7d-948d-aac8912c7d1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149772, "uuid": "293b992f-f91b-4783-b4a3-8d22fcd54205", "value": "PO 65090663(KB34).pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e22cde-381e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776184073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184073, "uuid": "dc73d081-d0a9-4628-98e1-a31f4286447d", "comment": "Malware payload (Mirai)", "value": "72aefc531402ed705519aaa7c125d19f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184073, "uuid": "560856a5-c9ca-48f6-9c80-baa1968b18d8", "comment": "Malware payload (Mirai)", "value": "89cb94076cb120d788a9d7178bfde969a30856f1683d1f1953b97383645efd48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184073, "uuid": "186c47d6-c894-4d62-b179-45f061092708", "comment": "Malware payload (Mirai)", "value": "c4c433db4b2f38923000263a3ac303bd13c234eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184073, "uuid": "a8961ab6-b7a2-4391-a2b3-8f01871365a6", "comment": "Malware payload (Mirai)", "value": "2059ab8f02a9c668c18fb75dc38af98909335a16ae8b680921339325d2bc068a4270099c1bb470a8abf2d55a86b7a2a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184073, "uuid": "f90d20a5-41e4-437b-8819-67fcc92d1755", "value": "T112F2E1B4961E54F3F1764E744F1E583E725399BCEAEA33155100633ADBCE00A1EB0557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184073, "uuid": "93e425b5-f7ed-4f5b-a9a8-40362ebb5076", "value": "768:irvZKJgRQh2i1pzqT+hxDgAEDTPk6dHF8vs3UozJ:66RIi1RqT+bDgAWPd/zJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184073, "uuid": "a35779a0-9c24-4a9a-8ca9-9f2da76e84bd", "value": 35948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184073, "uuid": "a0e4026c-0f2a-4c0d-917d-0a9c8c32bd82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184073, "uuid": "14a6448f-f18c-4add-8647-6dbfa8f5784d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b1011-37e9-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776160957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776160957, "uuid": "04a99e32-79ac-4cce-9725-36951e770af5", "comment": "Malware payload (Vidar)", "value": "bf0b47a84c050ac62954bbdca9e765bd", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776160957, "uuid": "cf439c05-130b-4d11-82ff-ad0eca6114cd", "comment": "Malware payload (Vidar)", "value": "89e832f99ed3d92e7dee36816b31e33d97d14e3a49f3b6be82b8e4d12701a398", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776160957, "uuid": "fb13b5e6-44c9-41f9-a5e6-afd43a7dc657", "comment": "Malware payload (Vidar)", "value": "94488a5042a25eef53eab5751fc2670840ed08dc", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776160957, "uuid": "6e3cf413-4fc0-4ebc-b330-21b63ae59138", "comment": "Malware payload (Vidar)", "value": "2b67b2214bec7b4d085f9062c06b3d996afa892d62c9ed85544ab41ffa552178009fab2194cf2a66f0dc1b6dc0a6302e", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776160957, "uuid": "fbf886f6-43eb-439e-afaa-722b0eff2f63", "value": "T1FDC58D0B6CA945FAC4AAA7328CB35191BB74BC190B3133D32E91BA742F767E05E74744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776160957, "uuid": "379c51af-620e-4351-8e08-94a34cf25e26", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776160957, "uuid": "75ca13b7-0238-4f12-a9e4-396e7efbcda0", "value": "49152:V8wUF76hNrCeUMcqmpGX3aHAnNd5MQCzHor79ssiXyDO/:VYylobGX3tnNUVswX1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776160957, "uuid": "ade739b9-6bb3-44d1-8540-c870f117845f", "value": 2596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776160957, "uuid": "52ff8f07-5e94-49e5-86bb-f265dd9d990a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776160957, "uuid": "648b50ea-165a-4d59-966c-014d03eddace", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4779572a-37e0-11f1-a769-42010a9c0008", "comment": "Malware payload (STXRAT)", "timestamp": 1776157183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157183, "uuid": "28ce7bf3-dc37-49cf-80e0-e544851a1b56", "comment": "Malware payload (STXRAT)", "value": "f9383b7840ff31fe914e13cd5924993f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157183, "uuid": "79e9dc38-ec53-4751-8321-d678726ea36c", "comment": "Malware payload (STXRAT)", "value": "8a6c39f97fb86a4ff9dc9226fa8b3445c5fe123abab532ea6afb9be2608780e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157183, "uuid": "cbe58e40-20f6-4a85-b846-94e47f605ab4", "comment": "Malware payload (STXRAT)", "value": "e2464454017cd02a8bc6744596c384cf91cdd67e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157183, "uuid": "1a96d45b-a632-4484-95e5-ab23d1259430", "comment": "Malware payload (STXRAT)", "value": "e9522ea54a2565a41f33fa1e184cbbfd035311379cf6cca270dcb55a2e40aad399619cf890d9fa53f3d1b4e770ad37fe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STXRAT", "colour": "#609F72", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157183, "uuid": "0aafa833-51f9-46ef-aa63-4aa8e850b534", "value": "T16BA50C65423FC874EABEA6368E5F399F0C6B495D003AB1F87A534D909D273128BF4D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157183, "uuid": "c9296d79-3408-4ea5-babc-4fd6426de4e9", "value": "4ace1d82b82edd3d6398fc649e502a7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157183, "uuid": "e70c67ed-8756-4d13-ba84-8ea9efeb3e0d", "value": "24576:I7Pml7Vo2ZXAdQ0YtjvM2GdXVJKMbcBBp6Rb2qHs96eHNuL:2G7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157183, "uuid": "99b82fb9-0bd4-40cf-9410-59962c93edd1", "value": 2217472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157183, "uuid": "8a375859-0917-4f93-96c9-4ec67d545520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157183, "uuid": "73f6db16-3598-47ad-aec2-a3427a620724", "value": "_8a6c39f97fb86a4ff9dc9226fa8b3445c5fe123abab532ea6afb9be2608780e1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3331c408-383b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776196233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196233, "uuid": "6753624a-f066-4bf4-8a98-152b025e0781", "comment": "Malware payload", "value": "789fd98a78d149b5527f298dfd10c64e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196233, "uuid": "a875a685-5e2f-4516-b575-1f9d8032505b", "comment": "Malware payload", "value": "8a8389a28931f6417470d50efb8d65c377bc78e9fb08b9cf0bbbec09ac082a39", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196233, "uuid": "7c515307-f814-42a6-9767-fc306da7fb47", "comment": "Malware payload", "value": "fa4b4da656154c810456f9b076412bc5a28468e8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196233, "uuid": "4f5ae6ac-31be-48de-9b3c-087beb27a979", "comment": "Malware payload", "value": "9180e4aa16aab6382672cd5bd28445fdbd735484e66253bce5ad8c5a576d927f2c686ed06f4c0ff41ccfa8d1e51784c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196233, "uuid": "7e8b548e-367c-47e8-b964-0d65693d0a68", "value": "T13A21DD1AD3005DF87985046C495FE67056CB03E74B1E2195F9DD68641F7C24DB2BC3A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196233, "uuid": "6bd1e42f-3fee-4232-aac6-a53714afd000", "value": "24:CEWiePYIEteYFBnaV0sB7C8hS1SgId/6FhS1RnCVlpQ:CEfKYIE7naV0IC8cdId/ihS/nIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776196233, "uuid": "1228f3d8-4e6e-4899-a654-5cb42318e39a", "value": 1158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776196233, "uuid": "5dd04601-ccf6-43de-9272-dd655f3403db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196233, "uuid": "931621a1-c955-4d18-8385-8df94d7de80a", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bcd47b-37ee-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1776163302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163302, "uuid": "07116bf8-b467-41ea-9fe6-ff92928adcfe", "comment": "Malware payload (OffLoader)", "value": "402efdd9379636798889dfdf7412430b", "object_relation": "md5", "Tag": [ { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163302, "uuid": "37d89b5b-3036-4852-a57a-8204fefd574a", "comment": "Malware payload (OffLoader)", "value": "8bedb791af407943a82fc4394b350b380380c4c8d61e23a65d004526dc9cc7fb", "object_relation": "sha256", "Tag": [ { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163302, "uuid": "9085b1aa-cf53-4482-b5e4-018e695bd4fd", "comment": "Malware payload (OffLoader)", "value": "f87cc9e671f7bcb2958e555c5fc3504a9e772f86", "object_relation": "sha1", "Tag": [ { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163302, "uuid": "2b2f8e42-16b1-4c92-a618-9b593ca2b6aa", "comment": "Malware payload (OffLoader)", "value": "efa984a9f1dbef7dcd8835e3c1ed1e5e54c651e3dcaef96cb9119adc3622dffcd35d6f3c892bef550ea976caa006f730", "object_relation": "sha3-384", "Tag": [ { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163302, "uuid": "f8f5c876-357b-4cf4-b769-c0b2d52a86c6", "value": "T16B57232B72C9523FF036963355B6E12018FB764BB0098E16A6D0394DDF2A6D01D6FBC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163302, "uuid": "c63174a4-0e48-47f3-a55b-e9e03629981a", "value": "196608:es9k6jzz+YsbaqA3xLSd9zj7TuN5kG5bB2wx:es9kO+EVNSP7+5kCB2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163302, "uuid": "22241557-56f8-4120-a130-65d35c390e02", "value": 27555436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163302, "uuid": "621845e6-0854-413c-b899-f8ae1940eb81", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163302, "uuid": "4127fae8-9377-4d80-8bfd-e0f81077f817", "value": "8bedb791af407943a82fc4394b350b380380c4c8d61e23a65d004526dc9cc7fb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9bbb5a-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127204, "uuid": "b47eff80-dc89-44a2-8444-163a364d8721", "comment": "Malware payload (Mirai)", "value": "234cabd096339ae39cfc875836493a8b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127204, "uuid": "cc27957b-d100-4ba7-994a-be1db9a5ebc3", "comment": "Malware payload (Mirai)", "value": "8c5f89c6d0af5a2fea9d123f13915c8a4abf8c1da2d0a0044c359daa3cd17207", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127204, "uuid": "2a5ccd8e-163a-4f17-b335-2071a21c70a5", "comment": "Malware payload (Mirai)", "value": "5b776d69d2c70782168f2bc57ba268a1713e3a1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127204, "uuid": "c9b50d47-03a0-4dd7-b53d-73455b578c8d", "comment": "Malware payload (Mirai)", "value": "c7f0df18f179d1084e8b74b26091379176306b3f65a81f3ce67f54de307134910be999d11747bc2f1fee0ca25cd754a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127204, "uuid": "5719719b-b4f3-4bfc-86dc-ab2c7f2907d3", "value": "T1C3835C43E9159F4AD103A9F025F289715B22FCB94C232EFAB876EAE44143DEC75463B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127204, "uuid": "c18afe6c-614f-4b76-98bd-fab46292603f", "value": "1536:eHSswOOILTSHeU8jYX0KuWiGK71uZSCAbubsx8xk9wx:eHNwOO+ST8jYruR0ZSXCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127204, "uuid": "32d59055-5217-4dd7-9ed9-36ea266c3b3f", "value": 87612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127204, "uuid": "9604279c-1baa-486e-a736-02d06db6225c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127204, "uuid": "d7868a3c-35d0-4dc0-b878-c1eeca36c77c", "value": "zyre.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a252338c-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147887, "uuid": "e39be4b2-0997-41b4-8769-0854141b150e", "comment": "Malware payload", "value": "ce66f3faba2e6fdb1ffec354ee50a254", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147887, "uuid": "da0d0d5f-eff8-423f-85db-036a4b2dc2ef", "comment": "Malware payload", "value": "8d6c9a0ee15669f2b8e2ffe7990de7bcedac26f28f5adb4578482252e43b48ea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147887, "uuid": "f9b4e704-9cde-48bf-bda3-eb7de745b887", "comment": "Malware payload", "value": "3e84973ad4127afb853a070991872234cdc79b96", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147887, "uuid": "1636379b-dca3-4b97-913a-d4ccdbbd3ea4", "comment": "Malware payload", "value": "e5d11f0b70f244e882514d09e527f073b37d2807f5db57348a53afd7b2b898bd562a8fa7f715cb8be1a70005f96f6d7d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147887, "uuid": "3819fb11-d385-4c39-9e31-b69f3bc72023", "value": "T1EC351204166DD912C82B1BF808B1C27527797ECEE432E20F9FD9BEDBB1797410A5A342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147887, "uuid": "d05c858e-ef20-4f15-b859-97f9c21b3d75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147887, "uuid": "f6f55f73-f848-4dea-b14c-64f94b3154d5", "value": "24576:MXoLmo6IhpbxzIKUht5+/LZBXRSSVtxtTsEqzO2a:M76hpt/at5QLPbx69K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147887, "uuid": "46ca77d8-77d9-40f5-a292-bc8801dbaa75", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147887, "uuid": "bce79d95-7192-407c-9480-5f56e41b681b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147887, "uuid": "fd752f8e-0543-4596-b3ed-f9eb10f8341c", "value": "DHL D232-184490,185290(1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b335ec1-37ef-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776163766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163766, "uuid": "c3b9b14f-140f-42a7-8315-afce3057fae2", "comment": "Malware payload (PureHVNC)", "value": "663360c5fe3274f50955590e70a92e0c", "object_relation": "md5", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163766, "uuid": "81f4f7bb-60ae-4633-befe-479a0c7238c5", "comment": "Malware payload (PureHVNC)", "value": "8dec7cf9811dfbc589875a259348cbac1f8fd49ee8818d064362bf5c164bcbb1", "object_relation": "sha256", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163766, "uuid": "f499efc7-7a51-4e86-9998-df0c0f228392", "comment": "Malware payload (PureHVNC)", "value": "e23ebd9b51cba35723cfd7a499f3908261c06fd4", "object_relation": "sha1", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163766, "uuid": "c47b4836-816a-477a-a866-30fb9453e429", "comment": "Malware payload (PureHVNC)", "value": "9eaa5bdc6098696010fedff372f7b8205048ec074f1a6220fa3ce1a0a171b01549baf58eaf19513e20c0d49f87c922c5", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163766, "uuid": "96d41c8b-61e3-413e-be8a-4b9db7a3312e", "value": "T1FA150703B3959A63D2586B72D9F34C0407F4A4E63763E74F7A95132928033A68E4F76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163766, "uuid": "54300541-2628-4d79-b317-f4941c24f86e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163766, "uuid": "0e23a4f9-226c-4d79-a69b-e3bcb122d825", "value": "12288:cVNnR5NI55xzG6yaICo4zVWCkWD5qKqoahJG3cjaM:4nVI5bKNaIvoD59qRhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163766, "uuid": "84277e32-fa6c-4779-87bf-da8b539cf9a9", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163766, "uuid": "6b1eb56e-ae2b-42b5-a538-a40f4dd192b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163766, "uuid": "84f1fee6-232a-455a-a21b-8f265c04c248", "value": "Wzpvrzrm.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9132da42-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130678, "uuid": "4d1d4279-7f48-4c22-9aa6-a5a2740f654d", "comment": "Malware payload (Mirai)", "value": "2104f91f8d8c8f6325a88bab6d3087ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130678, "uuid": "5cf66729-6b9c-426c-bb46-b556732c4edf", "comment": "Malware payload (Mirai)", "value": "8ed302d008afc374442f8474326957f67fcaab674c846765d13a4015671e03d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130678, "uuid": "347ff2de-02d5-495a-b26b-075061127ffd", "comment": "Malware payload (Mirai)", "value": "9a7592bc2293c482ad594c996394c3bcf36abf79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130678, "uuid": "8250ebc1-61f3-4147-9af2-6bd94f90631d", "comment": "Malware payload (Mirai)", "value": "91faba1d93fa757af36160b77f68fbe9400cbf4972e4d42f4339a24a2dfaba7081294e99088585c19ac2efd1abebb073", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130678, "uuid": "68a86e3c-ddbe-4fa4-a7b6-c832c17660b1", "value": "T1A4130807B94680FDC0ADC374477AB53AD53335BE1239B3B63BD8FA129986EA10E1D544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130678, "uuid": "9d070e8c-f82f-4061-a753-77ea6e958ca1", "value": "768:HO5xyjKy5klOY5lYDJN+Tb4//MgUSAnWBtxTWufBT7AZg:C4jKy5klH5lYFsTbU/Mk+gtxTWuFkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130678, "uuid": "1943fc2b-8124-4afa-94cf-b8dbfeaa6849", "value": 42752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130678, "uuid": "cd5f7da4-ba40-4c31-841c-15c33a80ae37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130678, "uuid": "7e7a69a7-1b3a-49bb-b898-f4add98237ff", "value": "0upx64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1937c9-3812-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776178959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178959, "uuid": "96df5c5a-0249-4942-bd04-cce5432c89af", "comment": "Malware payload (Mirai)", "value": "fb9ddf42dca361836fc92f124334bd1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178959, "uuid": "cfc14b1d-2282-4b74-9807-e7792f262d04", "comment": "Malware payload (Mirai)", "value": "8ee914cc7eb7d64acb26984820717c84d7569cec980101f70f62064384380401", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178959, "uuid": "feb951dd-1efe-4bdd-894c-2dea139beaf4", "comment": "Malware payload (Mirai)", "value": "8309c87a56d5b6a84998e586402e732dc10c67a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178959, "uuid": "1efe6806-c275-4061-8276-20d3dc31a3fe", "comment": "Malware payload (Mirai)", "value": "a52fdb449e16894aeeff86c1003438ac466ecf1ab319a03c3cd844531dd1ecd503b1cfadd3665f30144fc433aac9df01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178959, "uuid": "8b823fd2-a7f1-4e27-8cdc-2913f0ec9f11", "value": "T1FD142A45FC919B27C6D122BBFB6E418C331A27A8D2EE72078C255F21778A85F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178959, "uuid": "acc20d3e-101a-4913-a86e-49abe8c0da37", "value": "3072:l4ShqPYh9jtFxqV5XPIa4kpuc19j2gzP9wL8:l4SVhjFmdAa4kp1VJzP9wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178959, "uuid": "722b45b1-d9c1-4d77-b0c3-9213b0bf08ec", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178959, "uuid": "37a60f90-bd19-4479-a36a-a3a36ef25ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178959, "uuid": "6a6af3c3-1a3e-4170-b94f-e6df32557e92", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d974444e-37d4-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776152274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152274, "uuid": "2abd7faf-9b76-4930-8810-f2b4ec1bd54c", "comment": "Malware payload (GuLoader)", "value": "cedfc91ad34140f820f43586a664ebfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152274, "uuid": "f5b45930-bf55-4706-8872-9ab1589bb3ee", "comment": "Malware payload (GuLoader)", "value": "90907c299dedd14a8216eeddb937bbc77ab27924da77ad29592b46f982693414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152274, "uuid": "205937f9-aba6-4f3c-9f33-190aabdecd15", "comment": "Malware payload (GuLoader)", "value": "cceafb99ba765b3041cfae16d267241363605b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152274, "uuid": "e0e87bf8-a6c5-49b8-9e20-9f8dfff08cd3", "comment": "Malware payload (GuLoader)", "value": "40cac031100abbace50ad5a6de08bfe3c636fc63685de85e604b6d41c82c21060673b552dfc123be22315ac3dd59d000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152274, "uuid": "5f5ac65e-7da8-484a-b39f-34ed1a0975a5", "value": "T1D0468F16ED6808E9C5C2A37A883351537A38B800572133D76AD9636C2F637F4937AF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152274, "uuid": "240bd317-e4a7-4858-8267-624bd2e0d1e3", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152274, "uuid": "587edcfc-1ac1-463d-acaf-66c7801fc3a2", "value": "49152:+EN5p0Ek7OuKVC8OeO0klZqJ1ME70wkjq8QcH+fZevw7i42tC0pTqVR3PpwyY4K0:+E6kwErsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152274, "uuid": "2d0e842a-e454-44d7-b6f4-610ad9fbfd44", "value": 5584914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152274, "uuid": "deaf5495-3bb1-4873-a614-eafd63352652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152274, "uuid": "0613822e-5ee9-46e6-b600-f0a8deac10f6", "value": "wodoza.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a707d4-3811-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776178168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178168, "uuid": "a5958dfb-42bc-46e3-8225-c9e45c35a0bf", "comment": "Malware payload (Stealc)", "value": "f7acd77afb59436c2a2f6e4671f111d6", "object_relation": "md5", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178168, "uuid": "29b11f66-51ef-43d2-8bb5-be3f290b5ff1", "comment": "Malware payload (Stealc)", "value": "914887b9586d5571c8443c76f111c1159c42a12c9cffcda02d2d205663bb0225", "object_relation": "sha256", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178168, "uuid": "c607df20-9275-43f9-b1b4-41c2dee35482", "comment": "Malware payload (Stealc)", "value": "71890427e119516d605f641b4d464767ee743282", "object_relation": "sha1", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178168, "uuid": "314d79bc-90e0-4cbd-80e9-a1f26c0c4de8", "comment": "Malware payload (Stealc)", "value": "dd9badfa6902a7d5c1a4f71b3f3bafccf99506433a031dccc8c4834227ee9cbf695c9a1966c3e41f64c511a165b5e103", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178168, "uuid": "40feff35-aadd-4498-9a76-2af959c53fc9", "value": "T1A645CF45B794DE11E2B9637A41A085C087F5E4894E87EF3273D43DE269FF3902B1B12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178168, "uuid": "fbb1d251-1805-4fc4-9bb4-36ef6a613f75", "value": "12288:4zkfuOX6OnTPafQs3PsiQqCggvbS4EEIVJODVG0oau+2IwdmZSdbIsPHeCy7iC6o:4POX6eCQHTZEEsoG0oaclsm6ffJr6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178168, "uuid": "a1d1b788-f397-45b0-b499-cd95910f6150", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178168, "uuid": "782085e2-ce86-4cad-8055-d7d1a4212540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178168, "uuid": "88c27592-afec-49e5-a6f3-2b1de8eeb8c5", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a58366f-382e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776190823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190823, "uuid": "acb1166e-b4e3-4a8c-9175-502b6b52d810", "comment": "Malware payload", "value": "0dc86de3229f078446c63cfd302df4cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190823, "uuid": "32f901f0-e1e3-4bbe-8fac-434d0a6bb9c7", "comment": "Malware payload", "value": "920497bfc99bb67a73d1efacf60a452a4d59afa379f2723fe12873f2cd188295", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190823, "uuid": "87c6e03e-a8f4-4141-9f39-e48bdd4693a5", "comment": "Malware payload", "value": "5f3bcc1269aee2f5f81680f79e7aad0d7f3bb8c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190823, "uuid": "1e303d69-e012-4782-92b5-bc9479c1a7ef", "comment": "Malware payload", "value": "60edfabfd59c6a45b8aead2cf4edd3bb53f49f25f1aea3d6ea77545d9d2828c8f14279ae74681a886ad3c33aa4a1a4c0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190823, "uuid": "9358ba61-45e8-4ef9-a12d-c6d8dc3c7dca", "value": "T1D4A01108028032F800202E88B20A22C80232833208AA2388002B8C88AA0202F2220800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190823, "uuid": "190901c0-66b1-4ab6-8ab4-ec204b0c8a5e", "value": "3:lcQFzMlMyqrBFckG8LrObL7q:lR+yrL3/rOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190823, "uuid": "0cdae2c8-34bf-4f59-b915-88bee3859a20", "value": 77, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190823, "uuid": "6f5d0cc7-cc26-48a7-896f-45d835473d66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190823, "uuid": "e68dc9af-8f72-494e-aede-5137a1c42dd1", "value": "2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27dc62e-384f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776205144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776205144, "uuid": "203b653e-f3ee-4e06-b3e7-3aa2a381a456", "comment": "Malware payload", "value": "1c3238df4801db78686d6dbfb6149309", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776205144, "uuid": "fdf4816a-13a6-44f2-81a7-b7dfc7f88985", "comment": "Malware payload", "value": "93b30ae0de2bbf9101d88d8a4847790ab847e44fdbdea6a8e3248259fe53c854", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776205144, "uuid": "e0caf887-ccec-41da-b0cd-461cfee0605f", "comment": "Malware payload", "value": "0e4057981c59ac356d2aad29624961a5476f276f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776205144, "uuid": "9ee152e5-43b8-4fb3-820c-ba7f7a63dfb0", "comment": "Malware payload", "value": "9efdf94366067cf880c1a9ff736fef1f30e0217ff622cc21f256fd79ec7e8380ed6dbc4abbed4192e94486af6ef814c7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776205144, "uuid": "2965f91a-0441-4db9-b8b1-adbb3d19f60b", "value": "T18992D1EF35B7E410A4854D311FDB1E3757792A953EFB4A88E8302DAE55C26300497CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776205144, "uuid": "0e4cb1c4-6483-4347-af63-6c3bcbf60117", "value": "384:+zQySd1iEce+0YpVoOyp8U8d7IRswOXLSqls4EhGtGg8/mvMzbD+Nx6msL:+zQIp+hpQd8RsHXdv8+MXKWmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776205144, "uuid": "a85280f8-d610-4dfa-8f24-fec145104767", "value": 19402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776205144, "uuid": "80598805-0fcc-484f-bcd9-07413ea359a7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776205144, "uuid": "aa0402d9-dc0f-4c9d-bd5e-5669ae0f4c1b", "value": "Silent_Install_PLC.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6bc388-3832-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776192546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776192546, "uuid": "ec64ac68-1ecb-4f45-9ba9-707d8caf4f79", "comment": "Malware payload", "value": "3de83c192240df2a6b92fd8c4fe3328d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776192546, "uuid": "e9620157-34a3-4e4c-bd3c-202768f051ac", "comment": "Malware payload", "value": "940a7115284ba8c3f36582b8dc40e2f268c2fafa627ca4a9d0bc50217cebe561", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776192546, "uuid": "a243dd7f-3ab4-4e48-9426-0fad9456e0ed", "comment": "Malware payload", "value": "c755e5b59ad33e480c9136f63874c7c186e4af54", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776192546, "uuid": "a197f487-b484-4515-9b3f-42de00ee5d4b", "comment": "Malware payload", "value": "e9fa0127383b7bc7942687dcd883eb79bd23589c870f92a3178169297d7f0b0b6df608f4fdb698a9db0cc66ee41ccbfc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776192546, "uuid": "87863264-8925-4fe4-89c9-94b0ad3c5fdb", "value": "T140136D6566953C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776192546, "uuid": "d7c1d543-2580-4bfc-af3f-7a7627894ec8", "value": "768:bhXRWNGxVQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bblxfcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776192546, "uuid": "fe092599-c509-4509-94fa-005c28d660f0", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776192546, "uuid": "156124d8-cd15-431c-ac1c-97536e41d99d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776192546, "uuid": "b27abe82-c322-4e82-a7d1-1d01d52003bb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b354b12d-3816-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776180557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180557, "uuid": "4d1ccba2-5512-4337-8ad5-309b78c67719", "comment": "Malware payload (NetSupport)", "value": "25aa80998dc5ad3f4bf6c41c4e01fb64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180557, "uuid": "199c8c6b-de8d-4c13-a4a0-79eea66f306b", "comment": "Malware payload (NetSupport)", "value": "950d2f4d60ee5290de30701a96661bd5547eb012b1ddefc1f258cc711b31441b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180557, "uuid": "f6a257f0-a3ac-4f80-9a23-f206d569ba47", "comment": "Malware payload (NetSupport)", "value": "76591b3a03bda1baf2ee999c03fcd6c6d292f5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180557, "uuid": "806da994-eb1c-4300-9aef-b96bbe1e4797", "comment": "Malware payload (NetSupport)", "value": "8c6bd564a612adf26e03ac125c5c7d6d288fc6bfcdcbee1fc337457fd5a4b08c2854350fc251d7ab2493621ad8e07c3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180557, "uuid": "61e68a1d-ed48-4be7-8f28-7557a20ff989", "value": "T1AF469F12FDA809A9C49263768833A143BE38B440571123D76AD9636C2F637F4D77AF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180557, "uuid": "d52471fa-1296-4d80-a4a9-139170fc7f36", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180557, "uuid": "ac883ae9-e499-4fa1-b22d-6a52a87f729e", "value": "49152:6qVL60bTrmQKe9QzJxZbter4WLojeEvQcFvIecq6VN4338UtqSpdadeDa4yZtDYI:6qKir4WLiIqB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776180557, "uuid": "050ab40c-5319-4ae7-9e96-d186870ae0e4", "value": 5861897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776180557, "uuid": "eac88ba7-59f3-4942-9a45-444be0716527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180557, "uuid": "40b22d11-fdd5-4ac3-b01e-8f3fc107b359", "value": "SecuriteInfo.com.Variant.Midie.178032.85224921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268f7232-380a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776175167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175167, "uuid": "08159f64-e505-4437-81e3-70f1e6704507", "comment": "Malware payload", "value": "17212f4e2e3ce6d283bacaf2d0ea2524", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175167, "uuid": "2365baef-d3f1-4442-814a-f7d27475714f", "comment": "Malware payload", "value": "96ad97bd3816ebd44d00a42a667b31dec54fce719d07c6bcad5625d1791f887c", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175167, "uuid": "f9ecf84f-8198-4a27-9d74-7d059e32594e", "comment": "Malware payload", "value": "063f6d7b87c498654100184c820b44d56240c837", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175167, "uuid": "47c4f1a7-434b-4ef6-9e72-89193f1cedc3", "comment": "Malware payload", "value": "1da5dae4cbd5acd01efe0480af2e93e1ddfed27617b5af9546ba1e0586c1de46758df17d6eafa0e6ccceb6fa7d6f3724", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175167, "uuid": "67ed76fa-1b9b-4236-aa63-a0fc782431ee", "value": "T1BE67337FE29BB43EE069193939B29110453B7A60A0564C56A7ECF8CCCF641B10E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175167, "uuid": "678d8f1a-fd5a-4f9b-8aa3-e476b71fb2a3", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175167, "uuid": "c83ed2d7-e930-40bc-918e-0f6ffe604a69", "value": "786432:mESklQIak/B9RsfP06l6oFc33kMTTKP0qkd:7zakOFcbTTKP0Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175167, "uuid": "7b7a9fd6-9693-4463-bd04-c447d2729f44", "value": 30116818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175167, "uuid": "fcb0f463-2cd6-4310-a003-1c32a891fcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175167, "uuid": "80229fc9-05ff-4921-9f9d-15d89af20d0f", "value": "mugiwara_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feae0bde-37f3-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776165651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165651, "uuid": "57bef40e-ce56-4061-8ef9-f22dd5940697", "comment": "Malware payload (njrat)", "value": "4d413c8ba1b9a7a78ae3a768e3a814a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165651, "uuid": "d3ccb9dd-3d40-4fd7-9af0-e122e252d7f7", "comment": "Malware payload (njrat)", "value": "97605e4e7182fd2d727b7b86337f0b032e6540a646f2eeacb5a69365c75b213a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165651, "uuid": "44ecad38-832d-484d-bd37-01df12e0d34b", "comment": "Malware payload (njrat)", "value": "455c133948a5e50dd79da95e45ab58d1f796ccf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165651, "uuid": "85b9bb42-e464-4808-9b39-1f4da22a03ef", "comment": "Malware payload (njrat)", "value": "8a82b1ca7b84fae283fb878354ecf35e3fc9f39517966143b8fcca8346af54bd7b2dca44a373c9d08bd2a9f7436d37b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165651, "uuid": "0bd8718b-6f68-4501-bca7-ac329097f283", "value": "T1D9B20A4F3FB98866C57C177486A5965003B091870423EE2FCCC564CBAFB3AD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165651, "uuid": "a795dbd7-b9aa-4108-93b9-cbe6791de5a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165651, "uuid": "79b47440-5dc1-4fb8-a1e5-6b5285841099", "value": "384:5KcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZo3:5t30py6vhxaRpcnu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165651, "uuid": "d7366330-a8bc-4967-9a15-09634433c495", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165651, "uuid": "3e3a9605-eece-40dc-8ad4-263e5342330f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165651, "uuid": "6e173dcc-7ff9-4752-8297-17a3103fbc29", "value": "4D413C8BA1B9A7A78AE3A768E3A814A9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71458d7c-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127189, "uuid": "2ee7bcaf-08e5-4467-b783-f71e3a6866fc", "comment": "Malware payload (Mirai)", "value": "381fbf9f933b4e2ff5edd33c8455abe1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127189, "uuid": "3aa73fc7-0358-441b-89d8-e0551c09515b", "comment": "Malware payload (Mirai)", "value": "97b6f1f8382ea9b6fbaee404d991e3f71bb141f1e5c6f0f5c3bf5d8e42e0689e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127189, "uuid": "bb6923ec-7f48-4dbc-b137-83db58e3d189", "comment": "Malware payload (Mirai)", "value": "7c67ba380dcd78d206815194a413cb6134e1dcec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127189, "uuid": "71c975d4-a06b-4888-871e-0dac6a90b73b", "comment": "Malware payload (Mirai)", "value": "6e1ff52c9f1263ad3d5681fa28f9917f8ff8955dcb2ec6bf5660d90c5f0cf125fcabea1d988f3696ecfeffde03c182d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127189, "uuid": "66cc95d2-0ddf-4a2d-9c7d-a846a12f8f4c", "value": "T18B933942B7490F83D1532DF03A7B27F487AAFE9125E0D585790ABE865234DB2A403FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127189, "uuid": "632c4801-7510-4b24-891b-7040755c554f", "value": "1536:Yn8aBCyNmgnsLUJLcQWBPznwFjfvpPaFdhuKm3ZwSfL0ZSUrKbe98DVVUlhYpo:Ynb/NmgsoKPSjRnfLnUrcXnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127189, "uuid": "268314cd-f5ab-46d7-807a-0a9acea07f8f", "value": 96976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127189, "uuid": "198561cc-4dc1-4192-8e8e-7544db65bdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127189, "uuid": "7046bfd4-c6f0-416c-9a9b-314477d8c515", "value": "zyre.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aad93e8-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776152598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152598, "uuid": "005810c0-b6ff-423e-af20-7134b59bd0b4", "comment": "Malware payload (njrat)", "value": "0db620fe0d9bd76c5db42cad93546955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152598, "uuid": "f0657528-e9ea-4514-95be-65b2564c0347", "comment": "Malware payload (njrat)", "value": "97b9fbb1a39228d37f4c7830ac8723eff526317497ef94b2797c49d028f4f266", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152598, "uuid": "22e32c77-afa7-4682-a698-fc0430deaf58", "comment": "Malware payload (njrat)", "value": "d3a5908eb5c64190ced7ad1805a9ae72659926f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152598, "uuid": "adfae3eb-d09c-4a23-a049-dc6d26cf2c51", "comment": "Malware payload (njrat)", "value": "752a6d161ddccd83dfddfac930d7ffd3cdaf294ecd329362bf976ddedf31472bdca135d1e02d2aa3df62b1d3844726de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152598, "uuid": "d36c9e5c-c59e-4ba4-b398-68c0c659c165", "value": "T13F25C09073F4850AE1FF1B75F4B1485A4BB7B9526A36DB4F0D88A0AD1EB37408E503A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152598, "uuid": "b78bd467-3cd6-4008-963c-5147d3b02af7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152598, "uuid": "439b493b-1d61-47bf-84a2-0b4aad5ec13f", "value": "24576:rF/pTxJzck+uGW/yFoBkkAQmqGCH58oZJuD2Y:rF/pTTYjqqanTOgMD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152598, "uuid": "a6e2e734-4663-49d9-8272-70ec5b7a551c", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152598, "uuid": "e2091f4b-0def-448f-afd8-9b449a99cd1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152598, "uuid": "b388309e-9171-4f33-b800-8bd66fd6c291", "value": "Pulsar-Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850b9304-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776165017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165017, "uuid": "e72f61b5-90b4-4eaa-84a3-49af9837c991", "comment": "Malware payload (PhantomStealer)", "value": "a275dfeed8ae424ee4eb39e4e801ba6a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165017, "uuid": "4b5ce036-5171-4893-9ecd-0040630e6062", "comment": "Malware payload (PhantomStealer)", "value": "9a0c4f50526f556d0885cdd72bea9316dac5619e070071636da4e199ec922ed0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165017, "uuid": "cfd96975-0f97-416a-aaf3-aa48df7c40be", "comment": "Malware payload (PhantomStealer)", "value": "48716cbb6cfc670a2ab770323287b390e719024a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165017, "uuid": "bef3f013-8fd8-4f69-91a4-1b0d92b3e98a", "comment": "Malware payload (PhantomStealer)", "value": "dfffc5ac21beba14e166892b7ef650f4c33646a795ff61c2bf6355da38668a41da6dfa870cc910e6a1c765e1f4d08f53", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165017, "uuid": "535307b2-8bc2-4a7c-bfc1-57a85c972f4f", "value": "T187343B3ECB98011AB1B2D624FD960413F56B7B53233D8C9812C512894BB350E7AEDB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165017, "uuid": "71c8d0df-9f24-442f-a2a8-ab56f33e97e6", "value": "6144:+LUsO2hJs7/f3MasNsFP5huWPovIWRGQKkQ0Qja//yC:+Lkg0f3CN4PnezK/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165017, "uuid": "12986604-4784-407e-83eb-a814fcd53234", "value": 245940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165017, "uuid": "48daa8f4-7d7c-4c80-929c-795694fc75c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165017, "uuid": "31718ccd-ee75-4ebf-b1e5-a6aca37b4392", "value": "SOA & INV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d142903a-3834-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776193492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193492, "uuid": "a84aaf24-6de7-4f41-ab9e-fef65449c28d", "comment": "Malware payload (PhantomStealer)", "value": "59e2f3b5fb5dcb369f5066083a2c9247", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193492, "uuid": "cba8f291-d20c-4d67-848a-b13f0f7b8572", "comment": "Malware payload (PhantomStealer)", "value": "9b1022564f85ea763ae091fabd2a4acd590e755c058c4eec324f941c60b5b798", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193492, "uuid": "ea1d3f8b-f9a4-4fe8-a93b-e6927d68feff", "comment": "Malware payload (PhantomStealer)", "value": "40bc85e72b89f37c942294b2a028ecb26d5641da", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193492, "uuid": "4c438606-477b-42a3-96ad-d329df52f012", "comment": "Malware payload (PhantomStealer)", "value": "c4b4c3c239e45228b6b803d88123d3d0f4500a258eb18699119fd7b268999034ae62787f9fa7f889a2499e8c7f871c43", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193492, "uuid": "ae13dcbe-b4d3-455a-8be5-1b45ced4a48a", "value": "T1F035F21299CC6FB9CFE85E2D50BE121E73E0864B91166986FB337E46AFDB544020F1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193492, "uuid": "fc869418-4d32-4572-9a12-22839fd61477", "value": "24576:hJRBBRnO5jHOuSLtf8n1dcc006hddYMUaHrUT38y0aT8DIXc0DgXbP:fReix+scHNsy0aT8DIM1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776193492, "uuid": "fa885963-d660-4791-ab20-38377386d898", "value": 1155603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776193492, "uuid": "fdc09a45-fba8-4377-a051-a6fc7b351ebf", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193492, "uuid": "6661d192-0ac7-49ca-a090-26a117dbde70", "value": "ENQ-4503-RLVG-9-AN-0503-003-R1-DD.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51deafe2-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157630, "uuid": "41f1ea94-3337-418b-b27e-c8a06966c836", "comment": "Malware payload", "value": "26a1eaf5badc586b1981082752927d2f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157630, "uuid": "b2622145-27e1-4fd3-9268-98337155ed0e", "comment": "Malware payload", "value": "9b6fa1cb941cd8f3ff598d7b12463f223d5c5f096f675ef8a90068efa0a2a6a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157630, "uuid": "9c33d9c1-5ea0-4ab5-b893-c236c97482b2", "comment": "Malware payload", "value": "b33c9117c0f8e8fde34630702cf76ac04a550e5f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157630, "uuid": "cb07369c-ce89-448f-aac9-006b03a4b626", "comment": "Malware payload", "value": "c5be0dc8c85b76bcdf11da12370c2611a2c04eda7c7a4b530b56e6d6007e0fedaa0052db6bf9009c81c711362d200182", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157630, "uuid": "9f1c0b2f-400d-4ac8-adbb-3c250040b30e", "value": "T108B65C06BCC42BBAC46C4A7484FAC95122B05E144AF1467A2565FFEDBCB72797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157630, "uuid": "44e3b765-19e7-4b11-aa3a-77f710290d9c", "value": "98304:wT7CD6lMNEqwWwMcqoBANI7nQFKcIGCX4Zcxm:G7CoMeGwMcTBANI7QFKzJX4ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157630, "uuid": "2befa350-3054-47fa-8b54-bd6a95a9eca8", "value": 10900197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157630, "uuid": "d05d8513-6d7b-4059-a1ac-0aef83781acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157630, "uuid": "e2e6ecf0-179a-41b1-8581-5033f9b4c1bf", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3f4eb6-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149698, "uuid": "ea19765e-17a8-4b85-a5df-9995764807eb", "comment": "Malware payload", "value": "9dfbd1259c507519b9b166b6f5ff4202", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149698, "uuid": "d7b8f1c3-4258-4a92-87f0-4b626efd9d27", "comment": "Malware payload", "value": "9b99747d1b73fbca15dbc14f2cd30f2d6fc12362ba78f271d30c2b5351945c2b", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149698, "uuid": "1170aac8-4267-4c5a-b944-dc1174204403", "comment": "Malware payload", "value": "21faeb441a4f2d6c0cc9b6ede4328f8c208a13fe", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149698, "uuid": "65ba28ea-909a-48d9-b6a0-02c60385bdbd", "comment": "Malware payload", "value": "842825735d000028b8540184ed72c85c9bd8f460ccdaf07596346c9a6eff5d5540c201d8c9f9dd16945e2e865ff59dac", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149698, "uuid": "e5870066-c9c4-4928-987c-3d02bf6eec16", "value": "T10DB21E3EC984DFF00B6B31E1A95F7A16A5540363B9382A4DB9CF809D3B35650CBB01E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149698, "uuid": "558d8e99-3b59-414e-9989-556ee2d8cd56", "value": "384:K/8Zi6d5fWFP4QirJ7GC6lgl2mBrblV8hW8ckYqgD+zFJp302J8Xx8RQMKACEVv/:K/8ZipvirJ7Go/rR/+gD6qca4KyvbPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149698, "uuid": "3d0a1e80-0e62-4357-b5a2-282116d5a502", "value": 24297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149698, "uuid": "b7823daa-f962-457d-aeb5-b46b3e8dc1a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149698, "uuid": "6af454c2-b1a9-4a1b-adb0-2447ad69dbc5", "value": "SOSTENER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9e5775-37c3-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1776144686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144686, "uuid": "52eebdad-9f84-481b-b864-f937a4216c98", "comment": "Malware payload (Gafgyt)", "value": "eae9e25f34c6bc5476d635de2e1167fe", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144686, "uuid": "a0b255ec-248d-4bbf-aa95-632e122ff336", "comment": "Malware payload (Gafgyt)", "value": "9bcbbee0f2193e10b0701c1a4ccfd394f147b3bc85ffb8ba7652185a566d7071", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144686, "uuid": "f7c60324-f422-411c-97ce-314c17cbe453", "comment": "Malware payload (Gafgyt)", "value": "010e8917f983209c8f6aafa16a303d700cd1556b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144686, "uuid": "63fa6fc0-50f6-4cdc-9173-de2d0b42a811", "comment": "Malware payload (Gafgyt)", "value": "cb3e10a491cc4040ae75860e08dc079a56c7fc0c0c620c48e7189e5233f1b59b8082791b69c7c73c6475e84a1e4a1b1b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144686, "uuid": "5177bab8-5e80-4133-804c-b51736b3ddfc", "value": "T1A8F00551750731315FC65979A7CFD4A06D075842BC590574F846895F647C3BF731C142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144686, "uuid": "a643c02d-8aa9-4022-8dee-41aeaa055f95", "value": "12:1JLBGeWz8RvPrzkvCIsEANzJqUMDyRRNv:r8e3vPXqLlSlq2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144686, "uuid": "da9145ab-774c-4ad5-afce-8a1744191509", "value": 513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144686, "uuid": "c0267e3c-0ded-49a0-881a-c284c25dbfbf", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144686, "uuid": "0ba5f17f-f7b1-4598-a14f-e4dc8a4169f6", "value": "Sakura.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a8ecfa-37ef-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1776163547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163547, "uuid": "369cb000-ec5e-41bf-baed-4fb54d612a06", "comment": "Malware payload (NetSupport)", "value": "211e18a99ab82341d5dab7fb6fc5277e", "object_relation": "md5", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163547, "uuid": "da463765-5901-4cda-8756-8e0503b533eb", "comment": "Malware payload (NetSupport)", "value": "9c69a5f990b21e67385e3b39be3d7b09ea0a16ee6270d7837e869170c3cb23d6", "object_relation": "sha256", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163547, "uuid": "1cc0849e-81a4-4689-87cc-4c0bb7b1c1a8", "comment": "Malware payload (NetSupport)", "value": "44b63b81165c2e10040d72a1096484e46a9209a9", "object_relation": "sha1", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163547, "uuid": "4274cf98-f85f-4d50-8a30-f8ea61dd66c1", "comment": "Malware payload (NetSupport)", "value": "f3665da9b18f711c42db618085f9c6a57dc524a45737cfdae0a9eb5e55e2f04fe8dc388d029332c0f119005b9ab797e4", "object_relation": "sha3-384", "Tag": [ { "name": "bellatoccatags-com", "colour": "#EEC37E", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "lakestlucia-com", "colour": "#60ACC1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163547, "uuid": "d9ed66ef-24b4-4081-a686-bae95cd6f5af", "value": "T1D582B018EF660868CBD7A2325EA24BAEE90DC3D4914FC5F651B00CE7D597F880F94B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163547, "uuid": "357eab3f-e793-46f6-86bf-474f78c2cd84", "value": "384:j2OB4oKHCRFmsF8FeE2DD8yEP98N+YD7cks2jDiWjPhmvzYqPfVL792Bi/N:yo45CRoscPSfQRm0n5797N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163547, "uuid": "516ef879-118a-4699-90e9-f79f504e9a89", "value": 19148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163547, "uuid": "daeb0389-10d2-4fe7-8b13-ebae9f8e0d03", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163547, "uuid": "7170549b-39a2-4015-917c-f9a0eb87fcb9", "value": "9c69a5f990b21e67385e3b39be3d7b09ea0a16ee6270d7837e869170c3cb23d6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5162971d-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157629, "uuid": "6fdd6a5f-e018-4561-bff8-837914df617e", "comment": "Malware payload", "value": "4b479d3f3338defced75fd7ba58f7a06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157629, "uuid": "b75089f6-8c52-4435-8e53-c735cee94bb5", "comment": "Malware payload", "value": "9c932e0e6940fad9ce10c6d002acb0021cca5d300a503d572635967ce17fe146", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157629, "uuid": "3e7086b7-4fbb-4aed-b0cb-7665efc24dab", "comment": "Malware payload", "value": "892c6b08ea42abf83f00e62019d03a21be2bc751", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157629, "uuid": "0803aba1-d30a-4158-8344-bc42a5e7cd82", "comment": "Malware payload", "value": "a85c0956fc10bc4bd3385bbda98c5ae330a1269d13b88585489057b7745e808bb68d58d0969628a394014339e4e25de7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157629, "uuid": "c18b7662-ad69-4b0e-afcc-72aab995c4ff", "value": "T13CB67A137B6CE71FC228223409F2DA946B695C9201D7A51BB385F31DE9F20AC496EDF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157629, "uuid": "f8fad5c6-116a-4166-bb47-d5163311a2c6", "value": "196608:XnvMM3g63FVjVWzAk+1vAzHfoqY+Jiu1dxnv5dkYP8txF+n+nk/QOLYj:XnvMM3g63FVjVWzAX1vAzHfoqYvu1dxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157629, "uuid": "6adc6f96-190a-47df-af32-b6cd4b1f5df9", "value": 10967225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157629, "uuid": "2e5e5ca3-20df-4454-9699-16094c4ffda3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157629, "uuid": "6b16c4bf-40c7-4c61-9ea6-b7ed99c90ef7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7471f211-3811-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776178304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178304, "uuid": "df132cdb-4cd7-42fa-8dd0-14616eb5bea1", "comment": "Malware payload (LummaStealer)", "value": "44979681667705d1629ce21a631ee07f", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178304, "uuid": "37a3bf0e-4f8b-41e0-9964-dc6095d7a9ef", "comment": "Malware payload (LummaStealer)", "value": "9cf060b5b9afebadc04a47d55cb41c4791a559abe019327daa8ea54acddc603a", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178304, "uuid": "24891797-18c2-4d05-b42b-647b8e8d734d", "comment": "Malware payload (LummaStealer)", "value": "568d6e2af4e02ed54d0c9135277f994a8467a15f", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178304, "uuid": "371fbac6-f50c-4b6c-a862-589ade430833", "comment": "Malware payload (LummaStealer)", "value": "f6e2f6a8f802f03bbc98db28f001b9f92212f5d04593e3afc599ed5deeb6624f4d2485e998051009c4d7638c345dcedf", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178304, "uuid": "b5b79f30-fb05-4d41-b4f8-e40abfc5cffa", "value": "T132A56B00FDC770F6E40A563699E752AF273598090B369ACBEF903A79F9773910872709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178304, "uuid": "215fb2f4-afbe-4fba-9b4a-0c31c786f1d0", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178304, "uuid": "388921dd-182d-4ae7-860a-ac3ba4d16393", "value": "24576:Paql14nBfVp/g/LnWzPuV9Cp1wyFrLSSzIk8glYJU4SK2jBd4PjHkbQW5jIvnZLZ:PZ3+WVc/SW4SHIPDkbFsvhpbQjIwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178304, "uuid": "3bf7fba7-dbd6-47e5-b61a-cb0f041311a5", "value": 2177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178304, "uuid": "0669745c-f09c-49f0-9096-3ada36b0c4b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178304, "uuid": "bb579717-dd79-4105-a438-a26be9d02080", "value": "mixmm2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcc9cc8-3808-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776174615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174615, "uuid": "6732543e-f714-4513-a389-bb5a134be44a", "comment": "Malware payload (ACRStealer)", "value": "be1bde3e336d4d13f28292066965d6b9", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174615, "uuid": "32c0f2b8-ea5f-4bf6-a534-6bc50baed4d3", "comment": "Malware payload (ACRStealer)", "value": "9d33d30438c80adf72eed6bef7b2868a2ad651ec642fa97bf7f637a97c331aaa", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174615, "uuid": "607aee2d-ae5e-42b5-9246-f9b135208961", "comment": "Malware payload (ACRStealer)", "value": "11fa39d1edc21ebcd1314ab8dde08fda94b28a56", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174615, "uuid": "3d9ed42a-e26a-44a3-be47-73fb7c0cbd82", "comment": "Malware payload (ACRStealer)", "value": "69b5da25e583f2fe2914e496bf2b4e5a69e60d6eba92958619a78a761112df2705617a73af73142b804dda8d2167620e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174615, "uuid": "332aef16-c74f-4eeb-a265-40c8359a8d8d", "value": "T1DBD6BD326A02D83ED9BF0471512EA6BA95AE7D34173440D7B2E4FBC92E714C36338A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174615, "uuid": "64c0ee58-9fcf-4400-926f-ba01ef356f2c", "value": "a90609ee973c8ba5f091fd392ba83911", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174615, "uuid": "795377da-f344-460f-86c5-f0c996c4bc1d", "value": "393216:atoo5I2L8t7zulG8LYPtfjFlpjMrNxDCs/Av:Go+jL8t7zu8qrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174615, "uuid": "2422a866-f9cc-4adb-a538-89b689c038f1", "value": 12977152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174615, "uuid": "d28c4789-1b6e-4537-91e1-b18cb1c82847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174615, "uuid": "58d0003e-5232-4156-8445-21d9f0470d5e", "value": "python35.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dae308f-3808-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776174373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174373, "uuid": "22ec2dad-9562-451d-98d5-78e0bc25d9ee", "comment": "Malware payload", "value": "5bbe38a589af9f5b01dfdbca30094d7f", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174373, "uuid": "c657b68d-a59e-4e64-90d3-b4e4c24700a5", "comment": "Malware payload", "value": "9d476e33a5e98d77b833f7b77dcdd337ac16a52fc2a24e8cfd2f186a650f5de3", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174373, "uuid": "830b7d27-1b42-44fe-b5a2-7c551c3f4f1a", "comment": "Malware payload", "value": "6ddec977681a402e764fee92b207a17f21011866", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174373, "uuid": "ff7290e1-7d8d-4cd2-8007-6288c455aa6f", "comment": "Malware payload", "value": "45ffb3bed4b46aa7c05fdb2b8003a001e01f00e3d8778afbc0d56ef2a2af6aecd873356a4ac07564f2db9ca694838bfc", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174373, "uuid": "98f8f72f-5948-46f0-ae5c-781697f75c9a", "value": "T1DA92D09D4899915B43A21CB040FC60A535B28C73B504AE2CA175BE963B09DBF5C79ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174373, "uuid": "34c33808-7f67-402c-a12a-09bc5a6b0f4c", "value": "384:WL98AShThlpxQws7XnQUQlqkWw6PcIUNkcy1CNtkkMtl8+Q3jma:WJ8AITXpxVGn5QlqPPuy1IkXT8dzma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174373, "uuid": "d60b48c0-2b8c-4aac-a780-8cf137621651", "value": 20556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174373, "uuid": "f4ad43a5-07f3-4f69-8d07-686168c98a45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174373, "uuid": "13007211-fb86-4538-8229-fc4096739501", "value": "payload.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b316f73f-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147915, "uuid": "586d678f-5727-4299-96dc-59d3f3ff81ff", "comment": "Malware payload", "value": "35871136d07de0389f968fc1c18383f7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147915, "uuid": "6c82f6c2-d449-486e-90d1-025128b0087b", "comment": "Malware payload", "value": "9f1b0fd494f3abe4cb9fa0bb374c791fb89763558d5f7b04e3eaf8d7cece3429", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147915, "uuid": "bd4ffaa8-faf0-483e-9de9-ab0033bb609e", "comment": "Malware payload", "value": "c7ef52b80895c728ec13b22f9771e868c8095a11", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147915, "uuid": "c3adc5dc-af63-4a13-9d33-343de513343b", "comment": "Malware payload", "value": "99f09a6a42018ed7d302fad9411f1836b73d297a23e5f82b9d25f01cc3f5391e2c69968e28d4776eef0e88383674f293", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147915, "uuid": "d2b67c6a-5345-4378-bbce-ce1fdbf93f1c", "value": "T1F5C1894432FC0210D6B2CA789E704660CFBB380269B281DC5713155C2D31F64DE26B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147915, "uuid": "66ecef81-3dc9-405e-a792-60cb83f83ce3", "value": "12:8d/6r8orL3rVUqJrd4k7yYgkafO0luJFEeOos1GSEzwwudL/a/b/z:8d/y/1LyYgm0gJFJOb1GRzwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147915, "uuid": "a599c071-24bf-4cb4-8358-37ba00c4d35e", "value": 5967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147915, "uuid": "b537f83a-fe3e-47a6-973f-44d235006527", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147915, "uuid": "9bd417ed-37d5-49f2-beb8-537d05a1b4a1", "value": "Raport.docx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9a2cf3-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776149728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149728, "uuid": "2733f4d7-5c3d-4dda-bb43-da280e32818f", "comment": "Malware payload (ConnectWise)", "value": "fc99defb7abf89d7914bc580243c6f73", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149728, "uuid": "4c29b1df-7d62-4a48-8609-159968d3d640", "comment": "Malware payload (ConnectWise)", "value": "a048f1f9b8fb3fc3509672b9be854cdf42cc0c4a52c739edbca4f5194f62ca06", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149728, "uuid": "55b71a0a-b790-466c-96c5-ec2944de5e74", "comment": "Malware payload (ConnectWise)", "value": "30e0d060ac2b3d9c6006e0ef97592876674ef48b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149728, "uuid": "05424b3a-4763-4cd5-9435-fd591f8eaa55", "comment": "Malware payload (ConnectWise)", "value": "a42e8f7a09d76009f967896ac02be67fccdf8e49109bfb5e2ce3f2899b408f2519e8bf4c349d63b5138664999db02a72", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149728, "uuid": "99715c2f-f916-4ca9-b05a-39c2f23e41e2", "value": "T1894201DCAFB6F01532FBD3D78A919A118D1BFC0BA1157A4B1E4E0A14122D9C86E764F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149728, "uuid": "3b153668-b700-439b-8541-feaa136815db", "value": "192:pRuAt1rxGDnlNl/vHO3YY6YdYYUYY0Lnz8vUb3chDvv2:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149728, "uuid": "8b0d616a-0be2-4b51-a243-528c9726b460", "value": 12437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149728, "uuid": "b83ee3b9-035f-487a-b807-4ea7aaf80f27", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149728, "uuid": "1bbe9fb1-da83-45b4-ae36-5586de4ccfd0", "value": "eStatement_177375.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82398e9e-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776195507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195507, "uuid": "41ad6dfc-64a3-455f-9dfc-503b5a038d68", "comment": "Malware payload (AsyncRAT)", "value": "4329ecab94983d0d5f5e3f2a48e6d9f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195507, "uuid": "a4b9f8dc-3a20-4a4f-b661-3428278e6ede", "comment": "Malware payload (AsyncRAT)", "value": "a09983abaf1f037e8da8a9ad18079a2ce26a1c0ac1e2948390a4e916d77440e3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195507, "uuid": "2cd05dfa-11ab-48db-b8ad-2bb4616734c5", "comment": "Malware payload (AsyncRAT)", "value": "80c6eda739361a444c4324d78f20d1017eec47be", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195507, "uuid": "5c5d3472-bf8a-47cd-9817-a04e2a7eea91", "comment": "Malware payload (AsyncRAT)", "value": "0a0856bbf2de8f9ef0323fbc414838382f263b5ee28b6b6f7436d730876d9fd0c0f4321185ea9efb0806506b37ecb65c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195507, "uuid": "a2af78f6-4a39-4231-bbb8-15b487edfde6", "value": "T1BD233A003BE9813BF27E4F78A9F32155867AF2633502D64D1CC4429B5A13FC69652AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195507, "uuid": "3704c670-12dc-4e6a-918a-85a0df90bdf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195507, "uuid": "d711bb26-896c-4c6c-9032-f8081402c54e", "value": "768:ougGNTRAL97WUHZaiSpmo2q7aa9fkCR9Krrg48fPIoebojGPPN0btQXGS/SwXJPJ:ougGNTRQMB2lTCR9ypoeUbbtQXhj5Z4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195507, "uuid": "f3d38d63-7e92-4db2-9f68-d7f7d82f2112", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195507, "uuid": "5b28c618-c26a-467c-bc86-7c0af9575cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195507, "uuid": "935a526b-8162-495c-871f-82a9eed50892", "value": "81ip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f435ea4-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130675, "uuid": "202f9c1d-fbed-4f1f-bd89-2828cd8504b7", "comment": "Malware payload (Mirai)", "value": "1c01fc658231103885ab991ec6c960b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130675, "uuid": "f780829f-d63f-48b1-a014-c79d5877b984", "comment": "Malware payload (Mirai)", "value": "a2e959148579d56a6b0b73c64febefad5cc134878f4530f62df0afd9a0898ef3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130675, "uuid": "6352a6e7-0995-4ecb-9cbc-fa2c7a1eb463", "comment": "Malware payload (Mirai)", "value": "aa566136b8b07db7768b6b10bd90ecf5f4088c1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130675, "uuid": "0bdc6d62-e8d9-4419-8f7d-7a671b6e2cfc", "comment": "Malware payload (Mirai)", "value": "f1c88beadeaf213ae67e4eaa30fe3715d6009c0240064caae0c2e6a48c57f31f410b2bea90768d79a6c2d598d6ae9d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130675, "uuid": "f46fa8c9-afc6-49a0-a0b4-522eaff9f582", "value": "T1F1131991BC829513C6D4237BFA6E018D332623A8E1EF32179D226F4177C692F0E7B655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130675, "uuid": "d339695a-7b57-4917-a006-01b7fba9dbe1", "value": "768:PoGeguxMlBTlf0n3+mezK40lA0C8SazFXqTy9GM8gHLoKCKPN+eHbYYw:jegZzTlc28Sy93HrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130675, "uuid": "9e76d84b-c1f1-418c-9689-4408d885a674", "value": 44724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130675, "uuid": "57c0a5fd-e436-49e9-bc3c-3cc53519f32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130675, "uuid": "94c99a98-bc32-472a-bba0-6ec5c996051a", "value": "0uparm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6003f8b5-3810-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776177840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177840, "uuid": "9cfd5d41-7b66-496b-8126-9b935383d6e1", "comment": "Malware payload", "value": "571b08c42ee40cb7dfb4765c31db85e8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan.zbot", "colour": "#E743B4", "exportable": true, "hide_tag": false }, { "name": "VBS/Agent.CNT", "colour": "#1C807B", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177840, "uuid": "39bf1043-23c8-4567-bb5b-bee2b7afd7fd", "comment": "Malware payload", "value": "a330d9a9f623566f6b5a4610e77a52edb144ff4d534e7f0b4c8d523ab2cfffcb", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan.zbot", "colour": "#E743B4", "exportable": true, "hide_tag": false }, { "name": "VBS/Agent.CNT", "colour": "#1C807B", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177840, "uuid": "8932b724-6b23-4ee8-b4fa-a6abdac4360f", "comment": "Malware payload", "value": "a4af21cb99f492b420c13fe678d43413b0a75b5c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan.zbot", "colour": "#E743B4", "exportable": true, "hide_tag": false }, { "name": "VBS/Agent.CNT", "colour": "#1C807B", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776177840, "uuid": "21bda052-3339-475d-b6ac-2b272b92d761", "comment": "Malware payload", "value": "ea7ee16cd37d6d6e0e4bcbd496fd04956c21258cfb78257152aad429b77e19932dc682fe1b436d2d49613aad105546a4", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan.zbot", "colour": "#E743B4", "exportable": true, "hide_tag": false }, { "name": "VBS/Agent.CNT", "colour": "#1C807B", "exportable": true, "hide_tag": false }, { "name": "zbot", "colour": "#E1A420", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177840, "uuid": "f6d36922-315d-45c2-b07d-94b56d49a0dc", "value": "T1595623326F456C63C99047B5B10F6F217E7D8747860CD5E6A19CA0863B8FF90892F4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177840, "uuid": "7eb147a9-b515-4776-851f-de21cff8490d", "value": "49152:vD7+dqvcfsT5/iG0yxHnNX9hc8fih1qGdxeI+TR4dxyiNdznzg5jGegFuim3YUsl:4uim3YUspr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776177840, "uuid": "a2932422-4319-435e-bb8b-028457de9d0f", "value": 5902336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776177840, "uuid": "f9acde41-7102-40d6-9c92-c7e367112702", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776177840, "uuid": "d4ea35cc-3f9a-424e-81a3-9a2f444c2498", "value": "0VldcRGDA076852FKZEXR_83K0.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c316d169-3809-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1776175000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175000, "uuid": "49446bb8-551e-4bca-9e0a-b2f86dfe390d", "comment": "Malware payload (Efimer)", "value": "db759fcf09452826c17ed13c876a6d01", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175000, "uuid": "683bd6d7-f265-46c3-adf7-a3dcf26c996f", "comment": "Malware payload (Efimer)", "value": "a3d7ee308105111338b97f86e5d2493b903cc1a532272785f37f723216fc5ba9", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175000, "uuid": "153dde10-f8f1-4ba6-a759-bad9fdc1608a", "comment": "Malware payload (Efimer)", "value": "c55ef01a1dd67d85d36038f50bf528b70f7911f1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175000, "uuid": "637fe903-2daf-4dc9-a301-3ff697a2f176", "comment": "Malware payload (Efimer)", "value": "eb07b7bc8067bf5bd5dbc262f5f960ce3d6a6bc8b966b167c01b690364a2bece0c3feb0d27f855036a0b834797f8dc0a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175000, "uuid": "ca326d54-52bd-490a-ae1e-89e35a2bd475", "value": "T140C63309A5E2B0FDD633D030BAF257F1BCB8B83946718C7A2B94C2B16C87694953D857", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175000, "uuid": "5acd3255-7176-43fb-addb-e321b317e77e", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175000, "uuid": "4a731dd5-703a-4a48-b984-f59a27e695e0", "value": "393216:JpzgOZgk6PByPMm1qpKUSXMCHWUjXdcuI3/PGTAI:JpEv3BbmqKUSXMb8XqH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175000, "uuid": "0becd7a6-af07-4f75-902c-4b921bfab9b3", "value": 12612384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175000, "uuid": "349c0f4c-0f34-472e-acd9-d6db898cdd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175000, "uuid": "235e04cc-9eb1-4afc-9ec0-6b916615b98c", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862d9c5e-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162442, "uuid": "a6561a78-7a8c-47df-84ef-b873b80496fc", "comment": "Malware payload (Tofsee)", "value": "548df807eafefb5e58266cacd4548cf6", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162442, "uuid": "31788db5-ff9f-42c5-b131-bc7e7b24cf23", "comment": "Malware payload (Tofsee)", "value": "a40631e922384b82c0c1dc22f3a1ccc7a5d8b80927984b79d640058413d8a96b", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162442, "uuid": "ab789d67-3747-461c-8380-be7877b4b349", "comment": "Malware payload (Tofsee)", "value": "8f5634791ceaa0c499286f52b2a88edf22a2b751", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162442, "uuid": "8af91b3a-686a-40b6-91e1-ffb8ed99bea4", "comment": "Malware payload (Tofsee)", "value": "e2b716b6d0d3a5a7cbe5dbb163790b234595d4a59200e5ce863842d31408775b42c55adbd8fc85eca6f59478cc7ea614", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162442, "uuid": "5d499af0-d485-450f-bcbc-3a2c824fb4d3", "value": "T13BC6EE43292274F3D35757B4BC55B8E1A17388E0FF6606E1A944138948A27CEAFCBF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162442, "uuid": "88ef5527-ea1e-4b0d-bb4d-97552f058b9c", "value": "2c13b01641edb95de78761affa09fc50", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162442, "uuid": "70ea6caf-5c2b-40ca-8ba8-2543db3a319f", "value": "6144:FKQXE5cfNCEjNrBRkZzyQi70L789/drLHgDe7eVvaDtZV7+TgK0z/MPFPvM0R/qa:FZOcf0wNEbSWA1YaL8i0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162442, "uuid": "015a5fdc-2212-4171-a0f3-d3da4b81b745", "value": 12379648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162442, "uuid": "874124e0-628c-45a4-9a98-6e53a1288a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162442, "uuid": "55f872c2-f382-4c6a-8af2-4aee22525627", "value": "a40631e922384b82c0c1dc22f3a1ccc7a5d8b80927984b79d640058413d8a96b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfdbcd5-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776195661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195661, "uuid": "6f524bfc-8a11-4522-9e90-fb072b247cfe", "comment": "Malware payload (AsyncRAT)", "value": "62e63cae51260ed31246ec2904afde93", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195661, "uuid": "8ccfa967-b557-410f-9761-87756e6722e7", "comment": "Malware payload (AsyncRAT)", "value": "a427fa673e299b88a661fdc7661e833f857a2111bc12909048942f6b08be864a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195661, "uuid": "69089fc8-dd8e-48a8-9bbf-979c2258c5b5", "comment": "Malware payload (AsyncRAT)", "value": "302376af6278bef9d34cf0a3bbb14ac418362bb5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195661, "uuid": "892d77cc-4cc4-4f28-9f12-3dd547288ea1", "comment": "Malware payload (AsyncRAT)", "value": "adce3c86390813dce97575dc67ed9ba7e53118673b14711a91cea9ad8307e4008dd1fb27ba96e655f97a2dae9fb7a639", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195661, "uuid": "0c1f3c6a-80bf-4d9d-97d7-214e09d8400c", "value": "T12D232B003BE98236F2BE5BB8ACF26145867AF1633603D5496CC451DB5723FC686426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195661, "uuid": "9e98c53b-6e42-4c11-add8-d2f6cdd21595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195661, "uuid": "8c100e14-0186-46d7-8083-3b14ea0ae605", "value": "768:muKQ9TH4EjZWUR/ejmo2qrnw0QbKXPIqzjbAgX3iiZ0R33eYsD6AmmBDZfx:muKQ9THfe2i8q3bnXSe0RHecDodfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195661, "uuid": "cd9cc7c6-3a60-4fb4-ab25-bf4f5e9b4760", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195661, "uuid": "4563ab90-f7fb-49ab-b31f-5736b390c4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195661, "uuid": "060a2efe-f60a-43cb-8122-2cb6afbe6130", "value": "install3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9848e40-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776175387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175387, "uuid": "a9fa661d-f1a3-452f-92c5-e123afbf4c4f", "comment": "Malware payload (QuasarRAT)", "value": "ecc332f180aae3574d6ed0cbaf781e62", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175387, "uuid": "b359ad7c-9f7e-4bd8-8f11-77df77db3486", "comment": "Malware payload (QuasarRAT)", "value": "a44fd6518013d5ea59142ddefbcb835dcd3fb2bd671f19fb59fca75f85dbab45", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175387, "uuid": "376a2320-f94e-41f6-8900-292e3f9869e2", "comment": "Malware payload (QuasarRAT)", "value": "923f355982fdd9522f9c8e8cd5e9b12cfd93fe5b", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175387, "uuid": "7c5cc960-4fd3-414e-b24c-a822ed3f431e", "comment": "Malware payload (QuasarRAT)", "value": "7be29183aa481b4801a35dff6037dfc32d55e2d80a946b9791f4f52c66060a95dfbe26ff2c601bd8306879b192b58b87", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175387, "uuid": "4496f642-4ace-4d53-92fb-628b6cfb5138", "value": "T1804533750C9F8F2DB10335713D64DF6C896BA912D0258818CDF3E749A961E8A1CF8FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175387, "uuid": "2467aea4-f56e-4b44-b292-10048a8f9ec4", "value": "24576:eNMOUXMRZW8o5Ebxqko68bb3Zl9xenZTJ+HkIBdxLgbvQhWe6:sU2Uko68b3PnSTs3BLgbvmWe6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175387, "uuid": "587d1a46-16d3-4943-8c82-8891bb98b9f0", "value": 1218470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175387, "uuid": "d866ebff-5b53-4de4-8857-d04c735eeee2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175387, "uuid": "b396e8c5-044c-4194-b2fa-b6b151f78ca3", "value": "aIg_173_55.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb96360a-37c2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776144574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144574, "uuid": "4bd416d8-67cc-4b90-a9ee-c53471bfff5b", "comment": "Malware payload (Mirai)", "value": "bf9d9bc771abe26c70f04cfdf6ab9c3e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144574, "uuid": "7046eb0c-819f-42eb-97a9-2e8b7ef0518a", "comment": "Malware payload (Mirai)", "value": "a674741325ea257e6935082d253e745cf90d87cfe05075b93a92ab7c822eb200", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144574, "uuid": "93358eb7-4a90-4d38-94c1-9f8318933790", "comment": "Malware payload (Mirai)", "value": "743a2ed28965575d08ab1c11a25c23366b9ededc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144574, "uuid": "4b8c5c13-9ac4-4779-a5c4-eb0944c0684a", "comment": "Malware payload (Mirai)", "value": "0bb5cbc18230303c92ed5961e46278da449c741dd82b75997c1341c04a0ccf7f28e4f353f1fea4ed9e9a3e4c1e85d556", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144574, "uuid": "aa2fe596-6030-4444-a4a5-bca395a31b97", "value": "T1D0736C02731C0E47C1636EB03E3F27E1D3BBAA9121E4BA84751EAB469175E325586FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144574, "uuid": "1c9b16ae-a777-4513-9cff-c44a7ee180bc", "value": "1536:uDsT9KlroV3XSvgHgnerO9Au8IoRam8RFjv:/T9fVHLAOs8IlmEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144574, "uuid": "22cd2d2c-717f-4118-8f8e-7d2a7b9db1be", "value": 75900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144574, "uuid": "30a1197f-013f-486d-a2d2-6f0dc7e4d16a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144574, "uuid": "1328f2f0-5365-4eba-832e-b9cc3e1100ab", "value": "Josho.ppck", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b5c585-37a7-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1776132966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776132966, "uuid": "679e8328-da88-4bdc-aca0-90de3c36ba10", "comment": "Malware payload (RatonRAT)", "value": "5bc1f6f20b73afef7cad5b5c60591f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776132966, "uuid": "7e5b4313-f9ca-4c62-a0ab-20c9bb20663e", "comment": "Malware payload (RatonRAT)", "value": "a69a3e149d3953527bf129af100268c7cd0b2b954b453024ed360efe8b79e26b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776132966, "uuid": "8c116df7-2694-45c6-9d06-2f3816fb1e0c", "comment": "Malware payload (RatonRAT)", "value": "1a13df7e5293cb1a131d8357779b1d780a636b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776132966, "uuid": "c97b3642-0d14-4bc1-b752-c2ef96183fbb", "comment": "Malware payload (RatonRAT)", "value": "fe77fb624c6f4fcfe71dd7da472ee258c8c838139535066ee1ebd00767e9f1294f0eef52d08484783860eaab8d1f8301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776132966, "uuid": "e6db79b0-e2a3-418a-a481-54bbeec080e6", "value": "T1DED5121C33FACB18F2AF4BB4A87185664371FD179D62D76D58A039AE04B6F48BA10713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776132966, "uuid": "f5fe998c-441a-4173-91f2-2e1c6933be0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776132966, "uuid": "55da6189-e600-4bbf-8eca-6c6422f912a8", "value": "49152:egVUlsHjkmiGWU5FLGpMZ7iKPJ5W1tsclR0BxMzaRw4G6Wk:egVUuHjkDGjzqpgmwQ1GuRxzew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776132966, "uuid": "b387608c-722e-4edc-a6c7-20e5ac9de150", "value": 2946048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776132966, "uuid": "f07a04d1-7080-4d30-bf76-b38127dbcb03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776132966, "uuid": "3eab3493-5a71-4883-8929-0781b52b7a17", "value": "ratonClienttest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd25c9a-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149731, "uuid": "df0aa972-b3a6-49ea-80df-23c9ad5a2262", "comment": "Malware payload", "value": "efe93ea8e40b0adb38f7cd8bc628a73a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149731, "uuid": "282a8d0b-c386-420d-a58f-535940bae949", "comment": "Malware payload", "value": "a770eaed0e62cef1513ba80045da0d70a7ff15bca1cac8c0fd19e43374676fc1", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149731, "uuid": "8b0512b0-220d-4407-bcf6-79081f5dc07d", "comment": "Malware payload", "value": "7c6ecff8b58c8894ff05f3456cfe85f288a282f6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149731, "uuid": "216adea8-0b11-48fe-b8c4-d831a80fda9e", "comment": "Malware payload", "value": "859a8807e847bed9557520908ada7a91e567ebdffc45e5dee0337f1105b552ca7bacf6c7b66284a463a29a922f818db8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149731, "uuid": "4224676a-a870-4f49-8d28-31b9fefa92a7", "value": "T1F7745A493BB9DA08B7F38E0395E974AF167FFB662D19E61E3388074C057420491E17AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149731, "uuid": "18678d98-b4b4-4438-b81e-e022375bd078", "value": "6144:L+Lm9aehn4qbiEBHzRlEggp05XLEFZSN57Y4QhzEpsNLsigb5CJam8kwaBuMjGzv:L+Lm9Tn4qbRTvEgK057EF0Y4QysNLub5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149731, "uuid": "9533d600-66b6-4fe9-a846-5ba0df721c2b", "value": 340262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149731, "uuid": "da4a8cf1-7329-4977-b078-606ceee88ee1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149731, "uuid": "7a42c277-65b6-4aac-80e4-303a0e5a1347", "value": "COTIZACION #154914.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2728d48f-37e3-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776158417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158417, "uuid": "c241cc59-fe62-4da4-8e92-0c30fe8f432f", "comment": "Malware payload (GuLoader)", "value": "dec2115cd43890a8bbc25d6bde6da966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158417, "uuid": "72ede39d-c2a4-4808-b329-2243fe0f7ad7", "comment": "Malware payload (GuLoader)", "value": "a9c9e1381cd8ae21c15da76416165acda9ac9f9e0ba43d30920b45aa3f927292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158417, "uuid": "9ef43d5b-2d32-41a5-81c8-48362408fd70", "comment": "Malware payload (GuLoader)", "value": "eb37c051ca79138c0cd8cde24bd6844eb3f8de51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158417, "uuid": "ff97aaf8-520a-4e5e-8721-2d48718ed57f", "comment": "Malware payload (GuLoader)", "value": "387b21b7a4ac6436744b890d85945832d828eb9d13e01ee52da5c3afbacfd18266aaf6eefc188db99970976b318f705d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158417, "uuid": "40b6d077-1f71-4f36-9e05-ab1a6ba11097", "value": "T1AF651243792884C7D3A89A7C0D69D148AAB37F7C14A6930E32F67B56927D3735D2E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158417, "uuid": "d035cc17-553c-48d8-97ab-52628246ca7d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158417, "uuid": "a8a431df-b740-49bd-a7cc-9bd55d4b635e", "value": "24576:RYXcw/e6B3OFLWzdNZXIm4ZunMy7pzVCBXCHjs3VYTt+uVc24+HJ2WcoD+XnTdux:uXc6B3Td/XwYFpRCAHj8KZ+S1J2WnS3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158417, "uuid": "ee2d68dc-b7b7-4c7a-8db9-694a2926d111", "value": 1522184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158417, "uuid": "b2bd5dfb-a156-4591-9673-325f6d55aaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158417, "uuid": "bfe5a49e-d4b7-4e8d-98b0-d7cb1c74f734", "value": "a9c9e1381cd8ae21c15da76416165acda9ac9f9e0ba43d30920b45aa3f927292(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf1e1a6-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162452, "uuid": "0d7a72b1-1903-4c68-8001-5b340405f0fb", "comment": "Malware payload (Tofsee)", "value": "6365f702933b4898d9c6e63fe2a77adb", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162452, "uuid": "5cf49f63-f11e-443a-ba4b-ac3578e83791", "comment": "Malware payload (Tofsee)", "value": "ab6de94e2bd36198e6555b02c5dc2757b7713580d69a2869b4ef4146afb2dc80", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162452, "uuid": "e7890039-d4f5-4d8d-b9eb-884c6f5630a0", "comment": "Malware payload (Tofsee)", "value": "fbd632ed4dffc6a006d01411a1c538b6cb9a1adb", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162452, "uuid": "c7d1f879-e1bd-4aa7-a58d-5121bbf32a25", "comment": "Malware payload (Tofsee)", "value": "9836de8e90fab15562f59dd0c86c48f2487add9ebc111ed08d5e7dfbbcccca43264debc30dac8c67841b374bd810edaa", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162452, "uuid": "4990c333-2c15-473a-9697-7c557071999f", "value": "T1A8C60A02B76499D1DA624BF8583041D5A333F8917E5297A6EC48B30E8C67F899F23F35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162452, "uuid": "410e6544-fa37-4338-af7d-e2b0ddab7af4", "value": "ad179eb8d009622c95c11c2ffa3cbf38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162452, "uuid": "9a5124f1-7825-4a84-8269-89bcde471584", "value": "12288:KEidhAglQhyupVe0L1ZA1YaL8i0DCmer5+nIwaJCer5+nTer5+nTer5+nTer5+nf:BNgShFLAVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162452, "uuid": "85e32d14-fbb2-4744-87ee-fb7bc866fd34", "value": 11627520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162452, "uuid": "e03ee8bf-a5a3-411e-a3df-2ace7f5e4167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162452, "uuid": "01fb1203-11a8-4993-b290-97954199256e", "value": "ab6de94e2bd36198e6555b02c5dc2757b7713580d69a2869b4ef4146afb2dc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c038fa01-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (SentinelStealer)", "timestamp": 1776149655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149655, "uuid": "aa0afc48-1854-4826-83e9-2c9238c80375", "comment": "Malware payload (SentinelStealer)", "value": "cc760cf91b4782b954c79e03d2edeb15", "object_relation": "md5", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149655, "uuid": "30ef08df-2ed5-4509-ae89-d61ee491300f", "comment": "Malware payload (SentinelStealer)", "value": "accd06d7fa8f25b99a9f6bfd9be2f121c82f5d9a6eb1988e865385e3000d920a", "object_relation": "sha256", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149655, "uuid": "fd0d66e1-a48c-4a8d-af99-21bc6f418825", "comment": "Malware payload (SentinelStealer)", "value": "227e4a32b618932524dcb38e5fb4c46669f072fc", "object_relation": "sha1", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149655, "uuid": "f830b80a-db30-4ced-babb-0831abb45594", "comment": "Malware payload (SentinelStealer)", "value": "36a2bfeb6de41c989055fc627bc9dfd17f21012505cc2b91eb8b58a2323c8946424bb2f730c9941d4d8036b2934df018", "object_relation": "sha3-384", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149655, "uuid": "ee29b6b5-0afd-45ff-b981-8094f64c3a6c", "value": "T1B935233719262D7E1D241DCAA01E1D1D6F902DDB9025ECC8F9C2E8AB563CE432BE2579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149655, "uuid": "c59ba78f-a865-4b9b-b107-856f5b7d6371", "value": "24576:SLzT5N5ZKiJYimlHtw2hLX+V8nrTSawCAXjHlhY2ZvZcMF2:M5NpJYdrJqa+jHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149655, "uuid": "5e69f70b-a211-4996-b115-724009cf435a", "value": 1064595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149655, "uuid": "bc601f67-4576-4dbf-9b0b-e489d544b8b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149655, "uuid": "a3e7ef5a-2a80-4ab2-b3fb-51652ca9f821", "value": "Provent_720_SALES-Promotion_kt3uzd.rtf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7133e84c-3811-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776178299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178299, "uuid": "36bfb0af-8e0d-4461-892e-ecce1d45f6dd", "comment": "Malware payload", "value": "ea65dc5ed54b99e08f82e96bf4604e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178299, "uuid": "4d4b2da4-71db-422b-9911-f86fcf4b3db0", "comment": "Malware payload", "value": "ad6e6a30cafba3e88d315493253603196fc39f1aded32c1d09a4f139d1bead0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178299, "uuid": "084a9564-6bfa-4295-aa46-1c472a6bd42c", "comment": "Malware payload", "value": "8f991f640cf7b7461627a3246f4e858c6fd0d673", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178299, "uuid": "10f77ee5-3e2a-46ee-9ec0-b317ff97db3e", "comment": "Malware payload", "value": "8b843c6d71a5aa8ecbe884a942002e40f2e92ccfcd210a0753dcd18fc4738775ae1b83b758876da04fdad6cb8f5b1229", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nisuwyyyqsafdas-com", "colour": "#831C4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178299, "uuid": "d0760131-709b-4aa3-9b54-8c4d5b8debd4", "value": "T120C5E09067E05B14D19B61B8D9B78F06865EFE2007AF9ACB34147A5D6CB33D9CE72302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178299, "uuid": "0393b40e-1839-4ecd-99c6-fff67e6074ec", "value": "20fc126851771237a632c56439029aa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178299, "uuid": "22542494-b4d7-49f0-8344-001da9fbc173", "value": "49152:Z9kcMnsyP+DgM8YIiiBCjkrnewQQ89iBR1BjeFVE6H8k+G:Z9Ds+jkzAi1IVE6H8k+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178299, "uuid": "04cb63b2-aa03-40c9-af9f-5bfcfd31a123", "value": 2621952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178299, "uuid": "7e76a0ae-00f7-4a38-b765-a108cf538627", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178299, "uuid": "155c193f-0a38-4c43-bff3-89a4f86b7563", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8843ea1d-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127227, "uuid": "faa19b99-c388-42a5-bed1-83bc22bb6411", "comment": "Malware payload (Mirai)", "value": "2b33840a1f003cebeb2bd74fbe132a3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127227, "uuid": "d3ebc6c1-8c8a-4fbd-896c-fda8d6f040bd", "comment": "Malware payload (Mirai)", "value": "adb0466e3a15e6ef451d468e43970e832f5791c6bacf4c04124dbe7733139218", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127227, "uuid": "57c93f82-8934-4e4b-9135-f0ea4519e0b5", "comment": "Malware payload (Mirai)", "value": "84f06c6a25e88e22fb9a858597c2af50b999be95", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127227, "uuid": "dcf59422-c46d-4514-af66-95dfd75e491a", "comment": "Malware payload (Mirai)", "value": "102a86f1a4099e327c924dc499e852ea31efb1c0f95cefe1eb32a39dcfb51383a5ff584c52ae439e090b24733bb65450", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127227, "uuid": "75590cd7-1df7-44f1-97f9-1cdc1b71decb", "value": "T13EC3284AB9429F12D5D325FAFB5E418933135BB9E3FB3102CE219F60238699B0B77611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127227, "uuid": "c3bea099-cc82-4d19-b081-dc8e809665c8", "value": "3072:7YrbTPxaiMB7+55UVa1AbOBmYmSpXuJdELhE+fZamDC1H:Es7iWVa1oOBmYmSRuJkE+fZamDC1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127227, "uuid": "320f5172-fbfc-4e44-b4d7-5647ce1b1780", "value": 126412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127227, "uuid": "70566b23-f4c7-4816-b59e-fb447188c5ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127227, "uuid": "5273ae4a-6f0f-41a0-8b6b-2d78302e2b9d", "value": "zyre.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd9a823-385a-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1776209780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209780, "uuid": "ecddba5c-cea0-4075-ac12-de49e1088292", "comment": "Malware payload (SantaStealer)", "value": "44d8deced8bce82e324b555d824911e4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209780, "uuid": "d635741b-bc13-486b-8c75-0c50031d306a", "comment": "Malware payload (SantaStealer)", "value": "adc7f6df608b7579c4b020361258ed3349ff6de031f707afaea2945ccdaaaa9e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209780, "uuid": "b18d4dc1-d9d6-41d0-ae93-e2ee9e92ddd3", "comment": "Malware payload (SantaStealer)", "value": "b4f0fb697af1efd2983c24c27920a574f97bfd83", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776209780, "uuid": "406e14f3-3908-4cec-a838-d4382804b57f", "comment": "Malware payload (SantaStealer)", "value": "034ddb997a5361ac6b598fa624c595deb274d001056c8ed78fe4cbabe43c73ebca97846c499275434cc96f03bd68809d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209780, "uuid": "133571d4-85dc-4522-bdea-65c214e1373c", "value": "T1A856F43F9F5E10A8C8D6A8B0C2C67239E5B0B405406FA81FADD0F6319B5F9581E9B717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209780, "uuid": "27b2acf8-73e7-4aeb-8ae2-53799c2eac8b", "value": "d4d5b14dce9cc2248861ebc71b42aec6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209780, "uuid": "32c0da1d-1ea9-4c76-ba86-34d1eb651def", "value": "98304:2hWLgN+o7WiomysWBKYUzo+Cdu//PiIE7:2IUvysWBK9zotuHPA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776209780, "uuid": "03e6de65-0b32-4870-87bf-ec171c143530", "value": 5905920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776209780, "uuid": "433edadf-1c2f-47a9-a696-92e4d581c4d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776209780, "uuid": "83fe5277-8af3-46dd-9f0a-59b18ec20111", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c4714-37dc-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776155523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776155523, "uuid": "8d074c03-5441-4dba-a72d-daedaa530b50", "comment": "Malware payload (ValleyRAT)", "value": "0d3fb72d7a3b4382d309b6e21322737c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776155523, "uuid": "9a60c342-2afd-49f8-8d55-7ee58781cc42", "comment": "Malware payload (ValleyRAT)", "value": "aeecd2fd3a7446142a17bb7e46bfcdfed15cf358e1f2741f6576f8e153dd9920", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776155523, "uuid": "a6b6e18e-1f72-4127-b41e-85085d8ffd69", "comment": "Malware payload (ValleyRAT)", "value": "8c11ac50d79afd7556cab0c7b43dfb51af0e6e3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776155523, "uuid": "84c6f925-207a-4c71-820b-b8be93172f84", "comment": "Malware payload (ValleyRAT)", "value": "f98f984be62ff81e9da4a9c7aa57de10d7f05b02e71f991002de04cfcc735fe6ff577d21c75a96ec78da8f3b3ff842ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776155523, "uuid": "1e8b1987-5cc2-474f-b74a-3c60734b5268", "value": "T140A38201622044E4F3594B708952F9E099A6BC3D95F4F24EE278BE361E722835E7B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776155523, "uuid": "45e6e7e0-36b5-4289-b13f-29dad0f88cf4", "value": "417438e8da71861c6b35133ce3793a8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776155523, "uuid": "09f77847-9b9c-4fa6-bf70-af7f1077e87c", "value": "768:HFJ2l6Qw6DT3A/WXwzRPb6MtbgH0GnjlkkD7X8igLBLD1zzjsZU9qZU9ZsNUGHi:HMRT2d9bA0GnjZkBD1/4pMsNUGHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776155523, "uuid": "30afe45c-84dc-46c9-9963-bcdd6971b886", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776155523, "uuid": "f1eed1b8-e7a8-4f78-81c4-b6aabd905838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776155523, "uuid": "6ec9a667-4b93-4bde-9a91-ebf022fa5fc8", "value": "aeecd2fd3a7446142a17bb7e46bfcdfed15cf358e1f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb20b96a-37b5-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776138909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776138909, "uuid": "2872c929-fef8-41a4-9a0f-1fa5716f078e", "comment": "Malware payload (AsyncRAT)", "value": "0face858027a80fd2517bac5b7f4a6d6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776138909, "uuid": "afa2eb97-8238-460e-885d-e00212e9ce21", "comment": "Malware payload (AsyncRAT)", "value": "b1da5c5f8f75265343913f9dbb5578a0c97f3a05d730bf620e67b491fdae2630", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776138909, "uuid": "2638a71e-9382-4fd1-8d88-b6e0e186219d", "comment": "Malware payload (AsyncRAT)", "value": "1eda2edd886b32e3415f24034e2117ac4abfc05a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776138909, "uuid": "684fea0c-a6b5-460c-9283-bf26ec0439e6", "comment": "Malware payload (AsyncRAT)", "value": "bfcd2fdaf827eff9bde5db9f9a6a7705c5dab985802f0cc634634526c3b5a3d218841a56f5e1d2a8e9049087bfd2719f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776138909, "uuid": "09f2e8c5-698b-42f5-8471-917f3e17d72c", "value": "T17C333D0037E9812BF2BE4FB8ADF22115857AF5733606D54A2CC451D75B23BC2DA42AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776138909, "uuid": "d88ba40b-32ce-4096-bf6c-b92dc961f696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776138909, "uuid": "9b5c63ec-47b9-4437-ac75-0d8b4470f09e", "value": "1536:12u/dRTUPE20iUmGxZfbSAgZVAZZB7UdExKQ:ou/DTUPE2lcZfbSAg8XB7UWxKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776138909, "uuid": "7572af6a-e7b4-4e95-a8ea-13c1a603ff41", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776138909, "uuid": "ec6f0870-8f4d-4fe8-ad9d-c7fa0816f483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776138909, "uuid": "17bfeea7-42a2-4404-92b4-b3502b27a293", "value": "0face858027a80fd2517bac5b7f4a6d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5360b7-37c6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776146130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146130, "uuid": "b20e4d4d-5930-4fe8-b54b-7fa319cc6d24", "comment": "Malware payload", "value": "1f60c0eb1572277499f26e4fc6c9f935", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tag:DDosia", "colour": "#17AD09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146130, "uuid": "c522c353-94a2-4560-865e-f8f5ef839838", "comment": "Malware payload", "value": "b1de4f9db04929d9086e5aaa88d154f2b3a7d59eadad80e58dec31538fc5aa5b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tag:DDosia", "colour": "#17AD09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146130, "uuid": "525b18a4-8921-4ad6-8719-083f346be768", "comment": "Malware payload", "value": "cb0a131b390c6ffc864f2cd649db96a3a282c1ce", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tag:DDosia", "colour": "#17AD09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146130, "uuid": "e0ba81e9-e44b-4d0a-8ee9-0d1107d39264", "comment": "Malware payload", "value": "0af1e45f16cc0474ada71e6d5b9b98006c5cf83d0b117d0cd90085810949e80dab22fce32a415aa2403776913371f9a2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tag:DDosia", "colour": "#17AD09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146130, "uuid": "d29b32ef-809c-4c6a-9444-5a8d4d54efe0", "value": "T1BF87338AF748DA2FC437753249BA2671428B4D068E839797A9047F0C6DBB5C40F5AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146130, "uuid": "aef317e2-bdbc-4a95-99d6-d29216a638cb", "value": "786432:2V17kPygbOgDX2zddNWJmZG1aAyKs8patb+f1Thgbtif4lEd1VREyEb:2V1AyWOgb2zRkEA9ZayThStiftVFEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776146130, "uuid": "8297b215-a934-41d9-819d-81dc33002603", "value": 36171732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776146130, "uuid": "0f60284b-0754-47a6-844e-b0dcb1f59edc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146130, "uuid": "8b1bb600-b0fb-48b5-83f6-cdb971c38fb7", "value": "d_android.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36373407-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776191084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191084, "uuid": "3b2a61af-4aa6-49bc-9003-c8f7ccb30fe8", "comment": "Malware payload (SnappyClient)", "value": "022fdc417201f656e590ba8d72ae8858", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191084, "uuid": "843d9b0d-cc07-46a9-9573-8c6103c9ae38", "comment": "Malware payload (SnappyClient)", "value": "b239f1216fcfa250b34a0635a190de1f25da8c1133a67bea2f2f88531a8684ea", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191084, "uuid": "caf098c9-3c26-455e-b87b-841f7b1088b1", "comment": "Malware payload (SnappyClient)", "value": "f6eff823366797de90a5a6dce8f3a20a4ce5f60d", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191084, "uuid": "0c01119b-98bf-4fe0-be83-a4e360918a5d", "comment": "Malware payload (SnappyClient)", "value": "788e78670f38e191ae8685fe22df6a67064b95873572d528a9d4f0b580fd5a148a6f7d5f2dc32a9e73432ab26a945632", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191084, "uuid": "90b85782-1576-4adf-89c9-d39be51d2395", "value": "T1995523626322C63BFDA9EA7D5971893C0545B921B3B0C8DB51E0D3EDCA72CE0593483B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191084, "uuid": "49b6644f-888c-4d95-8a30-1b1c240f4abc", "value": "24576:2QzyMbUYFWSViEYS5Ocu+h3YfSmXgW45rwBmbHrZITFg04aD6Wlyq8:2UXbUYFWSV5jOcuc3JI4VLLNIm04a1j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191084, "uuid": "933f8832-b577-4813-b908-944f171bf4e3", "value": 1381888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191084, "uuid": "14127829-6c93-455f-b124-b8d96ee3ac2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191084, "uuid": "19a5d2cb-2c36-44ec-b73a-2cb7cfbba790", "value": "b239f1216fcfa250b34a0635a190de1f25da8c1133a67bea2f2f88531a8684ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a38d5d5-37ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776162825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162825, "uuid": "5dfe408e-3ad3-43df-bc52-0c291923532f", "comment": "Malware payload", "value": "cd84ef2f66d2f09d63d22352fe718462", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162825, "uuid": "6110eb01-f0c2-40a1-a876-802b7687cb2b", "comment": "Malware payload", "value": "b2be8ef1895f42981a717359ab2d263dc1351f7893ac8629ea6863dc76601d8e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162825, "uuid": "d6fc94e7-fa05-4953-a6bb-ab2cc774d0e2", "comment": "Malware payload", "value": "774cb9a0f6593befe30469dd3b73c4064aa0fb96", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162825, "uuid": "8dfa8015-484f-4bf3-8e71-9cb5a7b75db8", "comment": "Malware payload", "value": "76a19cdcb7376753751d0b1348a311387b49fc20470107322d30985723496b94aa638c5bfce8ddc5a1a9bfaf4d7a5d2b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "india", "colour": "#1F00DD", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162825, "uuid": "3d42c330-d3a4-4909-adb5-7293b2624a95", "value": "T150C62205FF0DE85AC8F392376E3106321A161CAD8703C3876A99B6395DF76C09AD9BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162825, "uuid": "f0ce20ac-e6f4-438f-9a8e-b9eae73e3cf7", "value": "196608:C00w9UZg0emlZxJ7ZaNgFybtssatnRm4eLI9HSL++j9k/jYr+xDsXh54ezHpfqv4:C9w9UZVemlvJ7ZaNWWt/aVRLe8HSLTZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162825, "uuid": "109c79bc-0a48-424d-a293-87db04c2fc10", "value": 11528343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162825, "uuid": "10ea7c91-04f2-4e04-9c53-2270048a97b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162825, "uuid": "54eae8f6-174c-4d7e-8e1d-2db675f61121", "value": "MGL GAS BILL UPDATE.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35e9c0f-3809-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1776174974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174974, "uuid": "88f66ba4-9d61-4fe8-aa84-5975c35d6e5a", "comment": "Malware payload (Smoke Loader)", "value": "c4cb87e6d6abaa5f8f31bcd68ce92f5f", "object_relation": "md5", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174974, "uuid": "88231e3f-dd9c-4a68-a108-d86fc24a1e00", "comment": "Malware payload (Smoke Loader)", "value": "b38fbaae45ea452ead61c91e5baae68be445a7e995cf95d44d062c75f9a2880b", "object_relation": "sha256", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174974, "uuid": "d6281960-44f1-4c19-b05a-86ed93d0f751", "comment": "Malware payload (Smoke Loader)", "value": "6744caa36be95b0d63978860be6a61b3e48e2d7b", "object_relation": "sha1", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174974, "uuid": "95963274-bda8-4823-8181-201374fe00d2", "comment": "Malware payload (Smoke Loader)", "value": "79b546da79cb99e0172369fa37d457822a51a925c3482e6bac65d8ee960db85facd9e2183a70cf6cc5501b9445ccf7f9", "object_relation": "sha3-384", "Tag": [ { "name": "baxe-pics", "colour": "#3BA02F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-SmokeLoader", "colour": "#5A7D69", "exportable": true, "hide_tag": false }, { "name": "Remus", "colour": "#A243E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174974, "uuid": "c2ab38b8-212c-4df0-94db-e1b9fd8c870d", "value": "T1E9A56B0B7CA505FAC0AA973288B75692BB71B8490B3233D76E9076383F767E01D35B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174974, "uuid": "69130000-cde3-4568-9d2e-e136b5d8a8f6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174974, "uuid": "81dfa8f6-6ba3-4a5a-ac9b-07956bb6532f", "value": "24576:ehvH3DtB/F/5vhog8/giZMVst75yB/Mhheleh2Kmy6pLR0tB:e1XxBd5vh6/T0st75CIwg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174974, "uuid": "a9ef9f3e-93fc-4660-aa98-294599ed85d2", "value": 2077840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174974, "uuid": "fbb3d562-00a1-4888-96fb-50367897dfcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174974, "uuid": "74519808-3108-4101-aae7-8d75aa4f2a46", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305c77ac-37c3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776144689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144689, "uuid": "540b9631-4ed5-43ae-8b45-c74e269347fe", "comment": "Malware payload", "value": "509d49bd308af7b48e3ce999baca75b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144689, "uuid": "8c771ad8-3205-41fa-b78f-a3335695e11e", "comment": "Malware payload", "value": "b3ace418b3a4d3bf27aaeb4aa5ba4909b1f1590b9cbedf58a3d5f5b3f1776c15", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144689, "uuid": "d104790e-5dd6-4395-bb66-6c8a4e5be82e", "comment": "Malware payload", "value": "fdfbdb5022500953d96b2d4de1d9ace18075e581", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776144689, "uuid": "f794a58c-3282-49f6-9b0e-58eeb70936f7", "comment": "Malware payload", "value": "3f2f4e064720e5c0143531df19da542b76fa543608b25e27d98ad6757d2976ef75b4d54ff2c16b5fe6d9fdeb8a5babcf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144689, "uuid": "38b8b98b-a835-4a54-811a-c15ec3d853ca", "value": "T1A841ACCA7AA3D97197C7C4381FDAE501E35624430996A998B08EBC303F69520FCB1E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144689, "uuid": "932be3da-50a5-4670-9ae5-7e4e79835482", "value": "48:xVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:DdnIu2mQlGaL2nKI3QaTGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776144689, "uuid": "461da92f-f40d-4c2d-92cf-1f1d5adf9053", "value": 1971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776144689, "uuid": "fc2d281d-9612-437d-9694-7ba7d408fbe1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776144689, "uuid": "0627a0c7-5c0a-4492-96af-d7232cac66d5", "value": "loader.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efbe3b7e-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149735, "uuid": "dd9235c1-a8d9-460b-9b18-be134d9de850", "comment": "Malware payload", "value": "2c59127af8b1633e34599f5c10121b57", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149735, "uuid": "135c3d56-b2b6-45cf-8072-787493a8dcaf", "comment": "Malware payload", "value": "b454b9f596f0ccb3abe9974128460ac21192530941f262c72438f5d099d4473c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149735, "uuid": "cbb01665-9d88-437c-9e7c-e2062d6797cf", "comment": "Malware payload", "value": "3be4f408837ad90f19f8363772127a460c5b948c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149735, "uuid": "4feed97d-5e58-4f3c-be05-aff692f4f484", "comment": "Malware payload", "value": "7a2de68714d2d5ff5f74dff0dc2f5494bc5ee5348b29de59c38ed8608e7b0468323dc254e0a8c8db847a7faff5aef608", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149735, "uuid": "28c51574-e98a-407d-af69-33d192a6b954", "value": "T181D50E775B407674BE3AA415EB8C36B94E9601BDFB503202D23F65822273AE110B77BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149735, "uuid": "1ec1def6-3e75-4afc-8053-c43fc60b5753", "value": "96:4gYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYgYM:VeNuWddiFWqIdpfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149735, "uuid": "75b8757b-d43a-43c2-81d6-e852247a4efa", "value": 2777450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149735, "uuid": "1526ea3c-29cf-4dc7-a0fe-443c70b51372", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149735, "uuid": "2108c4a8-04ed-438d-83eb-8f9feaf338ed", "value": "Comprobante de pago (TRANSFERENCIA).xml.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d413d1-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776147891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147891, "uuid": "e0872f3b-b591-4113-9a16-76566a664ce1", "comment": "Malware payload (PhantomStealer)", "value": "a63de281612af1d84fd9c6514255b78c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147891, "uuid": "1e417216-0139-4c31-a388-b36d35ea19eb", "comment": "Malware payload (PhantomStealer)", "value": "b513f80df9516b983b460b6110edc9f99d3acbe30c87a0c9a08ea434b871936e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147891, "uuid": "225bfbf8-4b64-41f3-86f7-0d743ae9f6ed", "comment": "Malware payload (PhantomStealer)", "value": "7f9172a00b8d6fc35837dfa6bae51517c0877e1b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147891, "uuid": "2ae69f41-a07d-4b62-b393-80e038bbafde", "comment": "Malware payload (PhantomStealer)", "value": "01a7f2b3c07c8d0ecc56e03ce782343d0aa2ec201a58c9ab44ee51e6b71e1fb680bbc811e9799571bc3137334464de91", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147891, "uuid": "a1316ce2-9db9-4afb-b6c6-950f2e6b17fb", "value": "T108520BBDC9D1BCC4835B32D039ADF6C5108E9B177E6B6B5CF9D805910B442A9EBB818C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147891, "uuid": "ae312ac9-6611-406c-bb29-9713fad2eb3d", "value": "384:wsjRAWt6zkUrpclcN5Ykdweh+YFqTic9yZMp8qcYkl8:flAWtCkuiwmkdweaNf8rYkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147891, "uuid": "426f9f39-7451-484c-ab57-060c1cf5670b", "value": 13670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147891, "uuid": "d20cea1d-9d5f-4d0d-80b0-b0b0911a57db", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147891, "uuid": "530d8592-1e08-4456-be83-aa5b7240955e", "value": "Halkbank_Ekstre_20260414_154914_989208 Hesap Ekstresi.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2820f100-37d7-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776153265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153265, "uuid": "233c6ec2-56d6-47db-9437-ad20dd617b53", "comment": "Malware payload (RemcosRAT)", "value": "1fff8680111dca41b126edab45170b5d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153265, "uuid": "a6330680-62a4-40cf-9d42-e24f813be3f3", "comment": "Malware payload (RemcosRAT)", "value": "b52868a2066e8432cce67c35fdfa3acc675ad0537e15973155cf4b04f2066e85", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153265, "uuid": "4ddd8f73-083d-4ae5-b171-6d1d51c87447", "comment": "Malware payload (RemcosRAT)", "value": "b295eae595346fe83ab57c4d630685838cff6b48", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776153265, "uuid": "2fdec375-e563-4692-bcdc-775f7dda3229", "comment": "Malware payload (RemcosRAT)", "value": "b4d8600c0403d391f33094e0e249735469d326ca7d2760ad88ce014531f6ce364dd3091a399c07c3578d723af976f6ec", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153265, "uuid": "69059e97-0274-487b-8eca-48f5a40641dc", "value": "T174E4F1B5F28C84DCC647887166A78482530EBC555F5E9B1730AEB72FB833BAC96C3512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153265, "uuid": "7fb897db-985c-42f7-91ad-b7f7fd907744", "value": "12288:uRpuLXIj3jpuLXIj3xQyTcXsOZYh9hXL5:uuDquDdywXsOZA9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776153265, "uuid": "f5e9504e-5800-49e6-91ae-2d801e279852", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776153265, "uuid": "66274d28-1e0d-4681-b9f2-7c6022dda27e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776153265, "uuid": "6f69287b-6c34-40bd-81fd-c7a313403be1", "value": "WAA_ROCMR16636352.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2a716a-384b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776203447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203447, "uuid": "9cfd2f23-ffb3-4b32-9a3c-cfd9a1c37962", "comment": "Malware payload", "value": "464a576ecde34ac8811f74da68d6ebb9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203447, "uuid": "5ee29292-4471-493f-a5f6-160ef27c0e87", "comment": "Malware payload", "value": "b614d771241ae25fd2e80e417ca87c0bc95bb379b940869ae72a08f620177c43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203447, "uuid": "2368ae4b-e872-4112-b59f-7f1cd9c697bb", "comment": "Malware payload", "value": "284cec5e7569ce766c2ec811b8bee1edc912d424", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203447, "uuid": "3458f6c9-04cf-4703-9da7-3f86c6ca83a5", "comment": "Malware payload", "value": "cd2dade7e821aa87f4bfe794a81019d9c02cb9f9117303f20911847cb3500a313d11e00ac5bccb48dc3a27a28ccf6a41", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203447, "uuid": "b656b890-de8b-49c7-b3b4-6ee494a8f757", "value": "T181C48D37EA6350FCC097D1B0935BE6B27932BC195670B92E068447B03E5AEE05B7EB41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203447, "uuid": "73ed1114-2d28-439a-bf61-8e258b5ff210", "value": "f94aa28992c19ec6ca964f6930d6f29c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203447, "uuid": "dc6dd92c-99d0-42fe-a103-a9d1e188600f", "value": "12288:v9YvM07tlx0rvP7CyMhtRbUfjik912A6SRVtoxLApdR/x4EJ9oVkCvw7U:v9YvMalx0rvP7CyMhjbUfji212A6SRVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776203447, "uuid": "767c2fff-facc-433e-ac4e-098b683cc2be", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776203447, "uuid": "cb9bb5ed-74f7-449e-9fd1-c6731c008770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203447, "uuid": "a9527e08-7183-45f5-80c0-875ddc8ede82", "value": "ServiceHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "673bb4c1-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776164967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164967, "uuid": "f7dbed18-d3a8-46c8-9fed-4aed2106dc33", "comment": "Malware payload (MassLogger)", "value": "d22c71e26c988b3576544a893cd47359", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164967, "uuid": "4876a0fb-94c4-450d-8690-2fb489d9ea26", "comment": "Malware payload (MassLogger)", "value": "b61a665f6b150621dfe93d8e889fc4b2f2ebc6f6cde64856f4ed19e70abfd906", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164967, "uuid": "70c361d3-d10f-4595-ba32-4f1ffe6864dc", "comment": "Malware payload (MassLogger)", "value": "9fff8c80532d4cc7440241dc97ed2d5eae92be09", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164967, "uuid": "619df742-1a16-4383-b031-b3445387ebcc", "comment": "Malware payload (MassLogger)", "value": "bef62e843671b49695ee68149a79d45bc9361adc19359c589fff4a7556da6feecacee33ee478d772f4750703774c6b4a", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164967, "uuid": "323a36ee-91cc-4f6a-931b-61979cad0c3c", "value": "T175B21D3EC985DFE00B6B31E1A5AF7A1695540323B4386E4D7DCE81993B36650CBB10ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164967, "uuid": "3846e14b-403b-4c57-9948-07a79d97527d", "value": "384:KY8ZiAzmcX5Slu051hcy+f9lcLceWY7+650chNBxMFH3ovew7V1FfkJ9DTt13VuJ:KY8Zi+Sg0q35GRhKQew7NkJ9DnJwrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164967, "uuid": "e18d21a2-4e45-4843-b754-0c2b5b6083a8", "value": 24118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164967, "uuid": "a1cdb9ba-a67c-41cb-acf1-1e33306830d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164967, "uuid": "4569a098-1635-4e09-b9e4-bb1c8b2a9dbf", "value": "Dekont.html.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bf19d6-3808-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776174271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174271, "uuid": "8a71e1b1-ce31-4435-9370-da95bfe8c16a", "comment": "Malware payload", "value": "ed1664136036c7b6f1bcbc3c630b21a4", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174271, "uuid": "28488495-7aae-4f9c-8cad-6bb65c634d6a", "comment": "Malware payload", "value": "b7a314c808c85a9f16702d9fab6e24c34de1636773243d29b352acc4960be1c1", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174271, "uuid": "b575388c-dc74-451f-8986-61204a0b6c55", "comment": "Malware payload", "value": "e55670830fd5642974815513e599dc08ff36a6a7", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174271, "uuid": "6e31acfc-d7d6-4811-99e9-b0b224966348", "comment": "Malware payload", "value": "9c6dcc1b7ffbd5ab40f2fa1421e8e13a875172a70481532dae7b0c9a2cd0c254176691892b27945091f0c45d527e31ee", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174271, "uuid": "f36aa2f6-a850-437d-b187-dd5b6a746798", "value": "T18EB423C0C89B76C85A4BF62DDD511749F56F96D9B2F6982E1B802F06F033201E9225BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174271, "uuid": "1741c1fb-e10d-42e9-9515-0adc045f41b7", "value": "12288:KNkGug7QMyMpVTXJjyEaoNYzuhgJ/BsyzTpIa:5Gv7GmVT5WEao+SQKyXpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174271, "uuid": "6ae221a6-98ed-4a83-a26b-a2185d373370", "value": 505186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174271, "uuid": "a1a7a8d7-c6e3-4887-b900-dc96c707c54c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174271, "uuid": "fff1f98f-d66c-4a5b-8ca5-a08b1c9eaa9a", "value": "Contemplado_chevrolet.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18052e9d-382b-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776189316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189316, "uuid": "9817ddc0-bdf3-4971-bc6d-9b277d1949f3", "comment": "Malware payload (ConnectWise)", "value": "f8553d7040a2e7e18872bae8ad7ec2a2", "object_relation": "md5", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189316, "uuid": "198e774e-02ce-4d00-b7be-0414b0339dbe", "comment": "Malware payload (ConnectWise)", "value": "b8034761261257069a59ea78cf95727425fc6b18016584764e2d2a9d88953ad3", "object_relation": "sha256", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189316, "uuid": "4ca5b67b-3b88-454e-98b0-7e3774c3aec9", "comment": "Malware payload (ConnectWise)", "value": "89769897fb28ff59eb4827c6881f0ec61447d5dd", "object_relation": "sha1", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189316, "uuid": "832c8743-8b37-44e3-90f3-a4be8fccf648", "comment": "Malware payload (ConnectWise)", "value": "a82acdf039d2ed51a030b3c93f5e25d3caad9a10c2a67b7f7a8bccb70db8f25c6f4c3c3000f688ff6356655e0636968a", "object_relation": "sha3-384", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189316, "uuid": "7b2cdf25-6c77-4937-981d-3d916c68c2ca", "value": "T19AD623226BFD0918E1F36778FD3A91E291367C659F12C08F2614785E6871E8097A373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189316, "uuid": "2c7930b4-336e-4fa5-999f-98ee4452acf7", "value": "196608:crnLYG3zDhukOArnLYG3zJrnLYG3z1rnLYG3zernLYG3zirnLYG3zhrnLYG3zA:cbDDDgvAbDDJbDD1bDDebDDibDDhbDDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776189316, "uuid": "046be86c-0d38-4e7f-981d-5c40f5edab05", "value": 13766656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776189316, "uuid": "37433d44-b506-471d-a8e8-d53debed8870", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189316, "uuid": "b9fae2ef-288f-465a-9ac3-4aa360e5ed3d", "value": "b8034761261257069a59ea78cf95727425fc6b18016584764e2d2a9d88953ad3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a005b66-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127230, "uuid": "da424ef9-a1b9-417b-bf10-4460e993f988", "comment": "Malware payload (Mirai)", "value": "09b7ba2a03e69b58f08fcb3a39947b30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127230, "uuid": "c9c6bfee-2e35-42ec-9865-c58814a235e6", "comment": "Malware payload (Mirai)", "value": "b899a1db33e65dd29c0d2cffc7749a2f6bc7b81b47f3a623686d6da74e946152", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127230, "uuid": "7d07c47e-f394-46ca-a82d-744c13870cbf", "comment": "Malware payload (Mirai)", "value": "7183aa3487024681f7e421cf413d76fdeca3d31d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127230, "uuid": "b240cc58-e40e-4f3a-98ab-69f630458963", "comment": "Malware payload (Mirai)", "value": "807a0332a93cdba75c59dd3f3a467d6ebd76ab5112636233e3a7a8506842dc4ed6c9fde47f163f64b559c61672d326c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127230, "uuid": "25ddfe6a-5e23-4451-9b95-396ae31c6ec3", "value": "T178A318A3FD07DE7BF00BA77780A308193130FB7149535AB672963D97AA791D52822F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127230, "uuid": "eabb6c9f-fb3e-46a4-8eab-4c410b53768d", "value": "3072:iwkK42Um1bExH4RAeBaZJjGNyFwp6TO8BuPsqUu1:imoH4yFA6T9BzqUu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127230, "uuid": "5898c9f7-4007-41d8-9a5f-f18d2eadf6e5", "value": 107128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127230, "uuid": "5ddb0c46-c5cf-4259-9726-345bef05e4c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127230, "uuid": "61773bf2-e637-45d0-bc80-e44e32187e09", "value": "zyre.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4881af89-37b2-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1776137428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137428, "uuid": "a947135f-5dd5-45cb-8c8a-59f4950017df", "comment": "Malware payload (njrat)", "value": "e88715ec4a65e76862ee9d7039a53bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137428, "uuid": "6f7378de-aaa3-48df-8884-8817f1204993", "comment": "Malware payload (njrat)", "value": "b8f9acdfb91f7c9acdfd131fd0d2f40468d444b993255e319e5ac4292ceb0937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137428, "uuid": "436e63f5-c4d2-4f48-93fd-ce4f5037306a", "comment": "Malware payload (njrat)", "value": "0c14b86074caef354112cc2f6b179e6fb9335257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137428, "uuid": "0d3b4467-8fd9-44ff-9461-fdd357b02916", "comment": "Malware payload (njrat)", "value": "0afa4b80de3ed11257641e922f364fec7d3a1ab23850bad472b8ea107236bb1ef1c890886c124fa70bf2489274ea1031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137428, "uuid": "d147774d-1df8-4877-addf-39c79040e30c", "value": "T11493E84977E56524E1BF56F79471F2004E34B48B1602E39D48F219AB0A33AC48F89FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137428, "uuid": "28894953-4494-483a-83c2-0606a40ba6e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137428, "uuid": "50659006-bce6-4d78-91e9-01f460d07fc8", "value": "1536:b+VFQWqkqqoLc2mJiIjEwzGi1dDSDugS:b+VmkqqoA2Gi5i1dcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776137428, "uuid": "97e3e413-3da8-4ef0-a350-b255b03d62b1", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776137428, "uuid": "1f0330a1-e9cc-4c18-9302-a2eb342f0d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137428, "uuid": "a113e2f6-7389-4c96-9394-0c8be450f569", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449d09c7-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776175217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175217, "uuid": "ae2fcafc-a472-4c7a-b215-e00baf665151", "comment": "Malware payload (LummaStealer)", "value": "1af172ef34bd4c7e8c40072c4bc074b0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175217, "uuid": "5c41c14d-41c3-4ab6-8c4d-35b78215b5f2", "comment": "Malware payload (LummaStealer)", "value": "b926a34de3a112f7e99fca9609570f4e78791e0b574e1de4f16ad4a92d2a4fa6", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175217, "uuid": "e73e841a-e2e2-4738-89e9-7a91688f155e", "comment": "Malware payload (LummaStealer)", "value": "6c7e0316341c29335afa15a044a70222406cdf44", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175217, "uuid": "05ca8ea4-8b5b-4715-985d-41e04702297e", "comment": "Malware payload (LummaStealer)", "value": "c6655a0f78af35a56319c3c5d4c04915d7fd3328f2716f5eebf8ab8cc4a1759d85e787da7b04372467a5fc0a35fb5cf7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175217, "uuid": "0f0d1266-ef5d-42ef-89bf-db33de97eb1d", "value": "T16CB56B00FD9774F2E903573655AB92BF2735A9080B339A9BEE407E78B9736D10932709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175217, "uuid": "42619bdb-b8c1-4f5c-a514-35cc49a8c685", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175217, "uuid": "c1b42570-abe3-476b-8255-a59b451d3c5b", "value": "24576:qcKnjvM2GlWg/L4TvGwgPW9yyjTUd6m2zJUuf+4jKdQSiwa62bKGQ3Yx+tj7qTOi:qvj3VgWUT4mdIZfIXgbQ0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175217, "uuid": "a1317d6d-2136-4863-8605-ae23a0dd17a5", "value": 2307584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175217, "uuid": "f48011ed-0316-48f3-b132-7937f13cdb1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175217, "uuid": "5317e652-5589-4561-8ae3-2d23291321cb", "value": "cx-programmer 9.1 free download full.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91f61bf-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1776147925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147925, "uuid": "b6fbaec2-be76-4495-9d5a-b3d0c53848c5", "comment": "Malware payload (RemcosRAT)", "value": "44eb6eeb983f18fd3f7c4b551f8653e0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147925, "uuid": "9c194b72-5037-496a-93ae-91b7244b4ef0", "comment": "Malware payload (RemcosRAT)", "value": "ba358abb563715ca425f9fce0b861227256c857284509a7989191f35e484239b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147925, "uuid": "7e18e630-c540-4c62-9315-590016232040", "comment": "Malware payload (RemcosRAT)", "value": "4b013abaca12155ac09956b7b960587c950832ff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147925, "uuid": "dc240ba5-1887-4a07-bcb5-44ee1ac54534", "comment": "Malware payload (RemcosRAT)", "value": "3cc4e6a9a26cda9cd8cbe2edbf9e9bc10b7648ded42e6baf7a7ea4fb7123fd0a9aee2dd1f550a9bf0612a89920a6cf39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147925, "uuid": "27762eb6-33d5-43f4-a481-be311e6064a9", "value": "T12CF24F2273C985A55D613918A200D8F05EEEC0D07F6473ED6369C48BB296C2767EBB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147925, "uuid": "86f9e8dd-c343-4d85-84c1-a768811afc63", "value": "768:3o1nCXpKudhOHbw36DXNjXRrXMVQo3PsJgF2YkIOKTbYM/UmSfj:3o1nMpKudhOHbw3+XNjXRrXM6o3PsJg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147925, "uuid": "29450e43-df5c-467c-98b5-a8d35ee463e1", "value": 36324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147925, "uuid": "1e5938b6-f8bb-4352-b520-9d5f04407226", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147925, "uuid": "e9534826-e2f0-4e55-9f5b-c3213d768b92", "value": "cloudconnections.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0decb32-3848-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776202028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202028, "uuid": "eda9683c-c077-4731-9232-060250892c2c", "comment": "Malware payload", "value": "ce0b896eb670041ea6ab7990f0a8f1c3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202028, "uuid": "69290f2a-4c36-423b-a75d-0d157749d1b7", "comment": "Malware payload", "value": "bb5d907414e75e7d6eb544b44592b5b91d4fec0a0c572d6730ecf62264d7bbc9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202028, "uuid": "17f25a6f-62bd-4263-a4d8-b5cfdd516afa", "comment": "Malware payload", "value": "53c1f830ccb5e1d8c74e241d20ee632070e23280", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202028, "uuid": "8b0d7777-afed-481e-a480-114673f9e275", "comment": "Malware payload", "value": "a9aff20c79efb691c47c0de158530c506fac492ce5b27c916dee9bb480027fffe32f189536dbb52642be2e498869c962", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202028, "uuid": "ec5e6757-f9a6-4a24-b0fe-0bf53afe5969", "value": "T1B0823B0FB9424216D0D200B49676867BD9B998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202028, "uuid": "bbb4c8ba-dc02-4911-b974-de802e6270f4", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202028, "uuid": "31fad75a-c6f7-43a7-9b49-a05f73bed385", "value": "384:+I78VGQic16wvw077u9NHuagBhav8U9cr:DAU0769uha0UY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776202028, "uuid": "7f4b194e-d447-4589-bc8b-70807948cc4d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776202028, "uuid": "4540b66a-5772-41d1-8c81-81cb87f1f59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202028, "uuid": "53bad916-9017-4f13-961d-e3ee2bea5a5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e093c615-3807-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776174190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174190, "uuid": "8078317f-232a-4d9e-b448-8405899f125a", "comment": "Malware payload (ACRStealer)", "value": "3270f542425f55aee4e749612e91107f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174190, "uuid": "f2839acb-f652-43e1-9c06-190a8526756d", "comment": "Malware payload (ACRStealer)", "value": "bdb4ae422dfc4735da014c46aea1f2aba9b0a1032f8a22e2e409170a37df9f60", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174190, "uuid": "12b38b59-2f0a-4fa3-8899-72d8336ffaf2", "comment": "Malware payload (ACRStealer)", "value": "da008e3751ef94a68956edd3b5fe1d3deb45c54c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174190, "uuid": "c90c7081-b649-4dfd-ac03-766b8df276b5", "comment": "Malware payload (ACRStealer)", "value": "5b6297a863af902a0da17457dbb2efd6bb9a687a333d87c22dbc824e510194e2c03fa9e5cb273d89198d67c14987f34e", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174190, "uuid": "34cb6c4c-632e-42f1-bda0-5f99a864fec6", "value": "T12FF633C6B59420CEF2AFBCFFF2BA261E1AC0D1599AC5401CF614094174E6EEE7B0D166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174190, "uuid": "618572e2-fdca-4c37-8062-67fcb6d6b312", "value": "393216:NFVifnN+Yt0QkAqKCVjxU1JTMcs929O6pEJe:z4fsZ3K8U1JTMcSo9EJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174190, "uuid": "28f6cc76-5a01-491c-b87c-bd63b73270bd", "value": 16727140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174190, "uuid": "6a66e7e4-bf99-4dd1-be43-0bd640cdfaee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174190, "uuid": "0002f0a0-2d35-4698-8e8f-5572cbbb1e4f", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5663792-3848-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776202035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202035, "uuid": "4ae50c32-79bf-4d0c-9393-171ed741d122", "comment": "Malware payload", "value": "a85ee6f7da46dcd90c1c322f58831ff2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202035, "uuid": "19670235-2652-45ad-8e21-d15548d22dfe", "comment": "Malware payload", "value": "bdf5791a2daabe8d077b42c72a6a1fb730c05ce158772ed391b84258ba4e94d7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202035, "uuid": "63dd8dff-4f87-4c14-b9ae-082a29d41c14", "comment": "Malware payload", "value": "5873d0338ee1fea48d4d70fe0c0f2f594c09c93d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776202035, "uuid": "12aa191d-2750-4559-a99c-b46d022a49ca", "comment": "Malware payload", "value": "a8c0c5aa1a5e7a5576aea24d4c1fd10b4a5d8849de60cf2196be64377d2ea76aa22c8cf3b4a64f2fd2e5e91806618a63", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202035, "uuid": "04819e38-ecf7-4583-8eac-9e6dcf405031", "value": "T163823B0FB9424216D0D200B49676867BD97998B637C814EBF7D08AEE1B686D1FC3315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202035, "uuid": "cdb051a6-64eb-483e-a543-77a5f64bea8a", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202035, "uuid": "cfb50af9-1035-461d-a667-29f5b32e24e7", "value": "384:VTI78VGQic16wvw077u9NHuagBhav8U9cg:VAAU0769uha0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776202035, "uuid": "286c394c-ee83-4614-a18d-87bff80ae375", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776202035, "uuid": "a1b9e5a6-5396-4813-8b93-b80477d3e5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776202035, "uuid": "1ce23b04-93a9-48f9-9d3d-226e228b8589", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec23bd2-37e3-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776158403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158403, "uuid": "61f0c695-fdd4-4c32-bb75-425813efbf9c", "comment": "Malware payload (AgentTesla)", "value": "8474b6d0bb51a92b8c91cb97205e9a2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158403, "uuid": "3504924d-5adf-46be-8f64-394af6032fe2", "comment": "Malware payload (AgentTesla)", "value": "beda707c37b8ac685d3676e6deb491cf45277c39d80cab10b6b9d67c0ec2efd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158403, "uuid": "f84a666b-16c9-485f-9010-d64a2259cd35", "comment": "Malware payload (AgentTesla)", "value": "1a40540b313c23a03d36e47ec03fc4bdd934b6de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158403, "uuid": "341e0e6b-b934-4f9a-8ad1-300b27f7eebc", "comment": "Malware payload (AgentTesla)", "value": "aa44b85f55518aa78b3ef7923cc214d2a5171fa692dc32a52e1a9be87f9588ef950579a601000aedde2ddee032697b97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158403, "uuid": "346ebeae-a3e3-476d-b838-09fa7ab5c454", "value": "T1536513837D2484D6D5B85B390D6496449EB33E3D18B6970E31EB3B2A917D3A34C3E362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158403, "uuid": "cb3d005a-f8f1-483a-91ff-b91f2db280a5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158403, "uuid": "ec25e05e-9661-49e5-a6a4-fab3241af9dc", "value": "24576:ZYXcwaTbr5mKwwibAGbMF57Ve5/YIyXQ5ElT3TCfiK5JfCtUA24UjReHGVulfmv8:mXchTX5tw3FMFAyQ5ElKiKIUAeeCuRVT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158403, "uuid": "992bd6f5-e177-4a85-9fca-031a8bb56259", "value": 1541072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158403, "uuid": "defba17c-7bb5-4ff9-9a43-97513b6eee38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158403, "uuid": "60a94dfd-4a71-4ff3-bbaa-454ec18b0fb6", "value": "beda707c37b8ac685d3676e6deb491cf45277c39d80cab10b6b9d67c0ec2efd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83153054-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127218, "uuid": "b314b911-c389-480a-a9d4-069cb3eb470a", "comment": "Malware payload (Mirai)", "value": "3b8e85a88c369438247d231becc6b05b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127218, "uuid": "74eda789-6dcb-4517-8ae9-f5a9a3c208a7", "comment": "Malware payload (Mirai)", "value": "bf101f897477443d080335427b93edf0261d810895deab6b0072fb2659219be2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127218, "uuid": "16f7b9e4-4a8b-436f-be15-389603370774", "comment": "Malware payload (Mirai)", "value": "bfac8dfe6b3f2b8e0d19f060a0d624a192e00f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127218, "uuid": "882d62c2-7d9b-455d-969e-f777bb313f18", "comment": "Malware payload (Mirai)", "value": "4cba48927a16d4a06596275fae63c704e5362b8b6a28b329cf3a7c40f7b3c457d4bb60f06082f3182315e384e35f27f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127218, "uuid": "c946f4fc-03f3-461f-a817-25920adcd341", "value": "T154933B43B7050F43D2672DF03A7B2BE457E9FE9125B09588795AFE8683308B22542FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127218, "uuid": "bfa124cb-c6bc-44f9-834c-3fa94db767f2", "value": "1536:kYo70DopLcAe7ohFzLTrc+z5xjs0m8epxumeTkGpTKXMAaSLXgwOSl56Apd:klI8FtUohtx+wTEMvbFA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127218, "uuid": "df6ca8ec-29b1-4e76-9b78-e48c7dd85a49", "value": 96800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127218, "uuid": "4f213d77-be56-4c3b-bf1c-63daea2fd19b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127218, "uuid": "0f9bb33a-4889-48ed-b406-035740374f5b", "value": "zyre.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cf0d2d-37f7-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776167238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167238, "uuid": "5bf6ca01-69f2-4d03-b67b-e278514ac2a4", "comment": "Malware payload (ValleyRAT)", "value": "0284f615a143680f51ef2071cd116a9e", "object_relation": "md5", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Androm", "colour": "#35C4A6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167238, "uuid": "b4f751eb-f221-40fd-a724-ebd8fd7c45b0", "comment": "Malware payload (ValleyRAT)", "value": "bff086a97125cc20493472aa103461c8b73e542513ec451c5d67a04f2da57391", "object_relation": "sha256", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Androm", "colour": "#35C4A6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167238, "uuid": "c2692691-ebf5-4cba-9119-b685f65ece3c", "comment": "Malware payload (ValleyRAT)", "value": "01bd88ed9a4682f3d9346587a88d497572c2b796", "object_relation": "sha1", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Androm", "colour": "#35C4A6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167238, "uuid": "d427d801-11af-4df2-8196-91aeb82dd969", "comment": "Malware payload (ValleyRAT)", "value": "207f82e6a881e1f2bd1ac18d9fbc99e9270832fb5b26898c7754dd189fff59c1bee7a49b87753cda27fa82ae75a25502", "object_relation": "sha3-384", "Tag": [ { "name": "Androm", "colour": "#08C503", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan.Win32.Androm", "colour": "#35C4A6", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167238, "uuid": "790cf7e2-11ee-4292-9e37-3c3ce3e399b3", "value": "T129453F9E8E3E93D6C0BEC5F4B3616296B5103C4CD17067C76B800B6D67276A0E8EA3D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167238, "uuid": "ac6fbfca-1bae-4a7b-8c99-ea9ef239d4af", "value": "2f3d5beda590f88cdf8a435791a181b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167238, "uuid": "31d50fd4-4d97-4b5c-9895-0d5b630e0408", "value": "24576:bRwS3pkBqUSIAsvrA7NfeILBEK5TQXNP9jfoetCc:iNP9jfBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776167238, "uuid": "7351e492-c6dd-420b-8ffe-13d396edc7f1", "value": 1268224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776167238, "uuid": "2b46be73-a14d-4e7b-9695-eb33a1846aa2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167238, "uuid": "871aa0d4-753b-41ff-8ab0-420b03069b6c", "value": "127.0.0.1_580.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebe6a20-3818-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1776181167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776181167, "uuid": "3ce24132-b564-4c8c-8b7e-6ad9cbcf6d67", "comment": "Malware payload (Vidar)", "value": "23adcef59c27ff38d45a1f6aaf23de71", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776181167, "uuid": "a56ea3f7-8512-4dc7-9ed4-d67d268b6af0", "comment": "Malware payload (Vidar)", "value": "c15ca14de416219eb5ef7e1bdd378fbe9a7795994fe2190bab94500923054ec0", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776181167, "uuid": "976fe94e-57c6-458a-ba9b-869937aa04d7", "comment": "Malware payload (Vidar)", "value": "28d26e9889cfecad61ca13f6436aa02eeab8cfc9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776181167, "uuid": "6bc6d73d-96a8-4fa6-ad91-88af2eda84de", "comment": "Malware payload (Vidar)", "value": "2274a2aa07cbcb775fcaf4e667ee886a9d34ba2ceba7b949ec698dc4bef9633c5d753b04aa46dc143f6360ceaab33a34", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776181167, "uuid": "16f42c70-ea55-43cf-b0d6-00eab568aa37", "value": "T180C58E0BAD9545FBC4AAA3318CB652A1BB70F8490B3123D32E917A383F767D09D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776181167, "uuid": "bb288f8a-523b-4b00-8b95-6dfce8633611", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776181167, "uuid": "13e0980e-3db7-4e6d-8bcc-9914c0e34964", "value": "49152:+JNnlSD5IMiCMGunE+T6MRSGdGGKXSARv:+JpcFzMPt6MRN4GKXS4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776181167, "uuid": "ac9e01cc-d83f-4620-b4e4-721d2aaea36a", "value": 2597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776181167, "uuid": "44cd0171-cdb2-4140-a2ab-d331f2b70073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776181167, "uuid": "99f800bd-46b3-41cd-8a4c-b02bf9d854b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38bd791-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776149741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149741, "uuid": "53009d04-7733-4607-b05e-a91362ee6676", "comment": "Malware payload", "value": "85bee5bf71343b2afbf285190744688e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149741, "uuid": "df4aa7de-a0c1-49a2-9ceb-c33c2fc03c36", "comment": "Malware payload", "value": "c25e3b3d6114c9812f6cc456eee6be6ac7cc5c7628ac17496817c034a89890c4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149741, "uuid": "5100317d-601b-4297-9c57-db8dfc4d273d", "comment": "Malware payload", "value": "98e37d90f3b98416eeae0c237bf81d554f662fe5", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149741, "uuid": "e3ddd074-109a-4bb7-8223-2e17d1150175", "comment": "Malware payload", "value": "0b99875cb84766aa55742fc0df0b04e504257becac7c987db727d8206d569f6f44611f249cf835b38ff4fa2a4678c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149741, "uuid": "a1b78003-c9b3-4e67-bd1e-e04bfac38543", "value": "T195D5CA292CEF427504927503B7EB1A587F700CFD83A7A641E9195AEBAE93F1C74E0E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149741, "uuid": "884fb60e-77f4-42e0-9d7c-87d3e53b5545", "value": "768:wzGGtyDckM7RDpze/8ALCmjRkJ0eOfd/DseqxIM9SoPtrwekNbzK/MNQk4sEtRDN:P/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149741, "uuid": "8359e946-ed11-469b-8134-c02b758c7396", "value": 2886581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149741, "uuid": "b1930ba0-1616-47cf-b21e-68b3b2acbe5c", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149741, "uuid": "0564b201-323f-4ab7-814f-f689af41d32c", "value": "Comprobante de pago (TRANSFERENCIA).xml.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a67c66-37a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130382, "uuid": "eb4b5e8d-f588-48cc-8aa2-b1b352f02ae7", "comment": "Malware payload (Mirai)", "value": "224515cdf697a5975b309e33ffddd283", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130382, "uuid": "3489fc5a-c8b0-49d9-bc40-514b2fbec692", "comment": "Malware payload (Mirai)", "value": "c2dfaf592a49510ffe220247b4cfca22e5ba161d3cc5f4c2361bf7f3a6a1226e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130382, "uuid": "5e8aa550-ae6b-4f15-9da1-8f0759ef11ec", "comment": "Malware payload (Mirai)", "value": "6049ade03e0573d45bdaa3b60467b26c68e07107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130382, "uuid": "d7ca2d72-c0c6-4018-9db1-9d8c2ac66ed9", "comment": "Malware payload (Mirai)", "value": "5b38ecbf926a3264367e2fb02ef03ded515f9d9e3f73bb836ca613ead02c04ded556e1c35ee40eb352feb6f8be9021bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130382, "uuid": "cfc5bdb9-1467-40ef-b634-4d0dc110d762", "value": "T13F234B21B9392F17C4D4A8BE62F74768B1F5164F25A8CB4E3D321E4EFF50A8095136B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130382, "uuid": "1d227007-e8c3-4bff-924a-453934bbcf50", "value": "768:Szo2nlxq9FtSPwsI7Uqzq/43Wiqmbx4O+qUEhY:SzlnlxSFtSPwsMUqw4uQxS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130382, "uuid": "74323f02-0733-42f3-ac08-8cc17f152b6f", "value": 46804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130382, "uuid": "678cb8eb-779e-42fd-817d-aa2fb66c0e56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130382, "uuid": "2570b74c-9c00-41ed-a13b-fd1e6e9ffefb", "value": "0upspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc1688c-3827-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776187658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187658, "uuid": "649d21f5-e5eb-4ed4-8eae-c9cfd3964b81", "comment": "Malware payload (Mirai)", "value": "ec86af36dd71749adcca4ef155bf61fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187658, "uuid": "5c6833c6-ab12-4903-a1c5-cec5f8123192", "comment": "Malware payload (Mirai)", "value": "c55a8ee901070db1bd703ace9f9c6a355f465fd19ca5aed6752d81f3bf5311d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187658, "uuid": "d24c3a60-b3e3-4c27-86dd-8344f2f6fda7", "comment": "Malware payload (Mirai)", "value": "54fd67ad7bb844f96daaca238627c4636f3971eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187658, "uuid": "d8587468-dd6c-4268-8e56-44140b585893", "comment": "Malware payload (Mirai)", "value": "8aa40f8ac739a28f183a9e22bf282397a0b00bd4ab5a34bc1565bb29befae37c01e274d921c6b54c0658f37527c7c84b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187658, "uuid": "f884e9bf-c53b-4c6a-b52a-db4421f41c59", "value": "T121143AC7F800DDBDF80EE73A48230905B530B7A21493573B635BBD67AD3619A4963E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187658, "uuid": "7f785e05-e513-4250-b42e-e7d07962ea4a", "value": "6144:JVckREFvznu8VjzTfjam8v1knOLU8yn8kN:FCjQv0SkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187658, "uuid": "afaaba73-c7fb-431f-8f06-2947ad903c9d", "value": 206304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187658, "uuid": "a995f7f5-1cb8-4cc6-be16-698a4f98cd4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187658, "uuid": "ccdaf536-42a9-4622-a81a-9435a8ff8d00", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f852a2-37b3-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1776137744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137744, "uuid": "b859505b-226a-47fb-844e-afbd497b754a", "comment": "Malware payload (Joker)", "value": "39f0810446b12c01ab401f5579959aed", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137744, "uuid": "9cc7ae5e-6878-4b4c-9d72-f11cd69bb000", "comment": "Malware payload (Joker)", "value": "c5df6f0fc153e74df6d6142691ed42cb445a41e5753f0ef78174d1a89c4124af", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137744, "uuid": "4dbf26a3-6238-48f2-9454-bd1b6d06ad78", "comment": "Malware payload (Joker)", "value": "f6eef92619c5d41a107381d0a21f38350ef50aa0", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776137744, "uuid": "cb88e452-ec30-448d-bb5d-99ec8b795c7a", "comment": "Malware payload (Joker)", "value": "9249f7ea6b30e9d25d22ea2190fe74213b1f4c3ca0fc23a28051f8f0e416898241cb31fb2787e3aa4b4022246305d969", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137744, "uuid": "19d92e51-e2cc-40b1-959f-0fdeb4b4b379", "value": "T14BE6234AF31DD41FCC7764724DA96332225A1C4B8242EB63B924765C2EB79D88F4AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137744, "uuid": "feb10726-282f-4325-9d41-82bed05b4799", "value": "393216:dv+hCPTcdcxatxLFE3J7E/DaHQP34bqU3lmvAb+RNljv7:dvWCrcdcWOJI8qU3cYaRNJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776137744, "uuid": "ad312d82-7e48-4cd2-b654-e40963b52399", "value": 14837599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776137744, "uuid": "4c07313c-efb9-4e6d-82a4-29764aca05be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776137744, "uuid": "0ab8b068-69e4-423a-a256-a672e683e6bd", "value": "com.fast.hoenk.cleaner_1.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a883f5b-3820-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776184649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184649, "uuid": "096dbff9-7c70-4e3c-a5c0-dcf52c950022", "comment": "Malware payload", "value": "886b5d84b53d5367961d3d77b42c75b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184649, "uuid": "93e6dabd-8911-4bc9-9cb3-84bb3b8203b5", "comment": "Malware payload", "value": "c5fe7db57a4b3092178682fe93e40341679b6bd9dfbde2c5ee18efed1cc41c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184649, "uuid": "355d739f-08a3-4d8b-87be-eb1defb8d145", "comment": "Malware payload", "value": "d41ce3c73a9a9f8a001b05d15d68901c44c86acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184649, "uuid": "22693d99-f109-4f2b-b5d5-c7e942fab5d3", "comment": "Malware payload", "value": "8aa655cf23b4ba18572562c8b3ac5e8a0d8a5c68730ffa2f40e43f571465492bf71dfa86c1a533ca134c96b9348507ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184649, "uuid": "f8e16be3-1ff6-4a55-94c3-91f3381bc7c4", "value": "T1D0B5FF1C07FA4607B7F3C4E5486CF613EDB5C83642B5B50D1E0840AAC2B56B369EDA7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184649, "uuid": "fbff6d84-7554-4cfd-a2dc-981c2bb7a2a1", "value": "192:UCASFFOdzEhdQv9ZdXjWZb1/LrKjF2so8jNYTnITTuI0kPZcedQDc1D/oGSoWgZb:UCwKaPqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184649, "uuid": "906bf2cd-9c84-4961-9374-b51ea0f63269", "value": 2438998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184649, "uuid": "caacb246-122e-49ca-a6f0-fd188cd50907", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184649, "uuid": "80c50945-727e-432c-b2bd-7a9a6af24d83", "value": "COTIZACION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1a75b1-3815-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776180198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180198, "uuid": "46fcc205-6297-4985-87a0-f1eb1a745e0f", "comment": "Malware payload", "value": "5a68b8c21eec15dc0fdaf1bbcbce20f6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180198, "uuid": "8e97808b-b588-45bd-9e71-4c8bfe30f2b6", "comment": "Malware payload", "value": "c68dee9f88e1eddbd6bfcd233f8c136becd1c7418ce9ae06ba457fb5cd5061db", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180198, "uuid": "563d0248-685a-478e-bdb8-12722c4e95c6", "comment": "Malware payload", "value": "86af6fd86ad5651f414631259f9b2f79d02028f3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776180198, "uuid": "84644728-e561-4627-bbae-9d9b4e6ded80", "comment": "Malware payload", "value": "a174c93377f1685f5b49016e5757e68e631bd29aa54c89da4b4b0bb4cfd8068f085c1ff120c7e07e7e602f5fcb13bd4d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180198, "uuid": "de27d89e-a77d-4ccf-a4ac-c29085041c78", "value": "T10BD59C11B697C136C97E45712A79EB2E50BE7FA51F7444EB27E84A7F0AB14C20231F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180198, "uuid": "a9c9d164-19bf-417c-b372-0fa2472656cc", "value": "49152:1KQYbm9Mftgk1A3VqVZ9Rw4YP/BD/vTyPduTRUhfwEbB6zDojOwfFl5pqLOSGRbB:7Ybs6AFqVPdVBqw1pqLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776180198, "uuid": "94bfc00f-1b68-49aa-8b81-a8d28d7f051a", "value": 2833920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776180198, "uuid": "4cb22c5f-d4c3-48b6-b008-f0421de24e83", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776180198, "uuid": "fd76dd8c-c3bc-407c-919c-6d4c66e59152", "value": "aiefde8.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ae6375-382a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776189102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189102, "uuid": "3a8b4605-1dfe-4d80-8a5c-ad103bc253e3", "comment": "Malware payload (ConnectWise)", "value": "5b891fd6a625a9c3122a2629ce08d3b4", "object_relation": "md5", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189102, "uuid": "311abf92-4132-4009-a7ed-0c7f3806545c", "comment": "Malware payload (ConnectWise)", "value": "c725aba2c38b06191c4fbb9337713ff3b8dcc8a4cabf0b4ecf089b12d89aa6c5", "object_relation": "sha256", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189102, "uuid": "042bbc60-4ecf-4303-94fa-a232c0021383", "comment": "Malware payload (ConnectWise)", "value": "1e4f37374fd26e292417ec7e8a27c3bd0f1be8f5", "object_relation": "sha1", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189102, "uuid": "0f1ca8a8-6b4f-4edd-82d3-1476adb66cf5", "comment": "Malware payload (ConnectWise)", "value": "e4505652ac1cf93d3e773e0acee4e5861d49b679df90319a3753fb4b3d38f8a9b6b56f277183253a596669ab9b4b8990", "object_relation": "sha3-384", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189102, "uuid": "a3491f6e-6bda-4db6-bb4e-fae246fc0d4b", "value": "T1C9311E42330DA1BC43BACB40D8244156FA1890CB120224FB7262D13C6F35798A3FA6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189102, "uuid": "a5afeb10-b9f2-459f-9e64-fb486bb8e21a", "value": "24:wKQ2DzldBgCaNxGPI3qY9nVVi3RHn/auNLvJrlV96FmVGgtHkXVsgFTrqe+:Y2XldBN4Gj6VVi3RH/dlVOy3SXPXqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776189102, "uuid": "56670f08-98db-4494-915c-6fb123dfca43", "value": 1488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776189102, "uuid": "8f781fb9-d8ca-4040-bd40-e71ea52a15cb", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189102, "uuid": "801ebfc6-40e6-4eba-801a-8f7b1f1dbb34", "value": "Adobe-PDF-Reader-Updated_Installer_709385-PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f54ee85-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130702, "uuid": "fa51eec2-d97e-4961-af67-61e7f991d1d9", "comment": "Malware payload (Mirai)", "value": "c413573ed206ea297e8ba70c9df24fbf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130702, "uuid": "82bda844-2319-4b23-9c2b-de2bb654baab", "comment": "Malware payload (Mirai)", "value": "c79da59b2fe597fea7329fc14a586713a0525d8e3be8227394f71660a52f9ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130702, "uuid": "26e43d40-7e7c-4ca6-a3c9-c7105b0509fa", "comment": "Malware payload (Mirai)", "value": "4faef050586d595bc8fc4e169cb4b77e5e1d7c4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130702, "uuid": "4e0a843e-7854-4415-998e-91926c9922dd", "comment": "Malware payload (Mirai)", "value": "f04891f7071e5a2bb8f4b6c3690b907dcf4256ecbebdc83f0cedb5f5dabbc14f2ee058226f6673761a8e72b83333c81b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130702, "uuid": "453c9c3e-b132-4f0b-adaa-14ed6be6c4f5", "value": "T195330A96B8818A12C5D413BAFE2E118E33136768D3DFB2139E106F1477C696F0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130702, "uuid": "7f7ab93c-ea5e-4f98-bedd-5871b24f345c", "value": "1536:gdnM5V7dJfTYKk8nYCzCpcugLiICiR5meQG3:nJLrvk2Y/qH5meQG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130702, "uuid": "e99bcfb6-4a2d-4e7c-9f51-dacd0dab7d36", "value": 54400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130702, "uuid": "76035bbc-7921-4709-855e-9a1dbc7e257f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130702, "uuid": "677f5278-17c5-494a-a16b-701c06788520", "value": "0uparm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fab0175-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776152580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152580, "uuid": "cebcfe08-dff4-4fb1-a854-3c3524a3520e", "comment": "Malware payload", "value": "b9a0b71d748b659e4bd9b771bef2c302", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152580, "uuid": "d29014dd-b658-4bbc-ae92-46fc3618819c", "comment": "Malware payload", "value": "c7e557cc9feb2615b132aaa8a2a756cd5461c9975186a2e7b4a609fb63b84e09", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152580, "uuid": "91ff7d8a-68df-4611-a492-2d07faec25d1", "comment": "Malware payload", "value": "491ed2434368ae93f4e6a0cb0fe0988526cc75a9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152580, "uuid": "3075230d-011b-4220-916c-f590a2851c3e", "comment": "Malware payload", "value": "2d9ed19d1b9bba60d09d8691d8f5b4cf30e12a5671bb65e1d3926b1467a06b5271e40e5ff61a74c5b3b3f47266577bee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152580, "uuid": "85099a41-188b-4224-8fcb-eadf444f9b92", "value": "T18FB18713A97D7097F8BA3171069A7F0A3D259CD1BEB8AE81040D35DAFF189C4D8146D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152580, "uuid": "00191b74-0e7f-4065-8bb5-49970c2a121e", "value": "96:ZSQ96G2bsBWfD+/ElbNo+tkM5Wybu00m3e1:rXe0ElbjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152580, "uuid": "5be7326a-50b6-430b-8fe8-bf8593e58db2", "value": 5481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152580, "uuid": "2d537ca9-0aaa-46a9-bc2d-098caca5cc5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152580, "uuid": "59919ca0-b265-4737-bd85-3d4ee16108cb", "value": "ideasserverRUST.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d663afd-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776157596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157596, "uuid": "b42c3b61-dc6b-4488-abeb-a8ad4eb90b6d", "comment": "Malware payload (AgentTesla)", "value": "ae93864982dad21c5bfc381fdac03d96", "object_relation": "md5", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157596, "uuid": "de823148-6817-454a-ab80-fbc5fcf73a9a", "comment": "Malware payload (AgentTesla)", "value": "c8e7131b8bbbfa3693d17161e00b5d4a0ad9091ffbc1b9917f4d239ba7f314ac", "object_relation": "sha256", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157596, "uuid": "6af1acfe-865a-4f0e-8fd7-93d4eda6f501", "comment": "Malware payload (AgentTesla)", "value": "dcae1a468536648975e6849bf74287cbfb355c92", "object_relation": "sha1", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157596, "uuid": "c1c5823a-eda4-4c48-85de-c206abf57f32", "comment": "Malware payload (AgentTesla)", "value": "7b0262927df64892f0bcabe23449b72c1cc0221dd9c1dc610427a96682fdfb1211b31f9348d88d921125c068f72af4bf", "object_relation": "sha3-384", "Tag": [ { "name": "46-183-222-116", "colour": "#97EF02", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-holzbrenzii-com", "colour": "#A2211F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157596, "uuid": "08295917-e0a2-413b-9f33-a14be46d392f", "value": "T1EAD423017924C453F3322AF1DC6A8F726AE87C64F6518A5F2BC03E4F7DA7951780EA91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157596, "uuid": "58a99012-e923-4a40-838c-2f8f686081e0", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157596, "uuid": "e153b22a-2c3f-4ae7-b720-9cda19f3c456", "value": "12288:0X4jwQ0CnmQC9Qf4Ct8v5kFoTNdvR0t1DVP8EAl4soOBRvAnBs97gTd2h5YwvDlv:u4jwQPR2kSvtZstN2NBRvZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157596, "uuid": "dab67184-5f11-49ff-9aa8-40f7d6dc3564", "value": 651660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157596, "uuid": "081348fe-f2ca-4d82-a9d7-c21bb3ae8c76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157596, "uuid": "c26dba5c-dafc-4ffd-9bb6-b9c4ecf34f9b", "value": "CopiaDelPagamento14042026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7602343c-3821-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776185179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185179, "uuid": "c8fb3360-0613-4e47-a4aa-e3768b8d9d4f", "comment": "Malware payload (Mirai)", "value": "299f5915ff6caaa84dea6ee5274e848d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185179, "uuid": "a078215e-0924-471f-ad59-a669227da4ad", "comment": "Malware payload (Mirai)", "value": "cb41018ee276a8e7528bf5e911df608b5faccf206fbb18b10ed73d8b3dd669df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185179, "uuid": "7c0e9e26-e733-4145-bafc-1938259ebc00", "comment": "Malware payload (Mirai)", "value": "f52b9639d683ca8e33decb6d7a42983bb484dcd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185179, "uuid": "d4930e9f-901d-4210-b428-9f1954aa188d", "comment": "Malware payload (Mirai)", "value": "43732c3dc1e8d42d1ebcb3d434e37fac09c1e119281fe483ddf81598b1c9a10d51294fb270577ede92d25f17bd4f6799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185179, "uuid": "cdbbbd52-ae08-4773-916d-bbc1151963d3", "value": "T11D9302D0F57294F19B704B362971CF85A3ABA679B1EE73275096000C62C19341FAEB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185179, "uuid": "be34a02f-6404-43e6-ad90-0f3952658928", "value": "1536:NtJJesr+FwSg/14MlkYeHCaARHyamh5/EpkkzLHwK6oPXrwSHOk6WgcuTG:XJtr+Fg4uk1HCaAU5/ElLQs/rwmOVWgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185179, "uuid": "31ecd228-dd6b-44c5-b9ec-d62f98ccc61a", "value": 92200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185179, "uuid": "91ca5f61-4778-4237-8e72-6f2077313103", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185179, "uuid": "9a2490f3-f1c2-4fa3-98f3-92419eac0355", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29eb6b9-382e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776190864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190864, "uuid": "e7b0a4aa-489c-47f0-980f-90ad2dc6454d", "comment": "Malware payload", "value": "9cb6818513160c6c2253be390da9263c", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190864, "uuid": "d4a8009e-196b-455a-a5dd-80ce9cfb2508", "comment": "Malware payload", "value": "cb561d927ceb1a4fcc06c43552fbf8d0cc36e212610b6e487da769d055b93585", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190864, "uuid": "65a70b10-314f-4ce8-98e4-82a293f620a2", "comment": "Malware payload", "value": "928d27a3349ee535e7348c9d4d62d3cb8c01ee01", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776190864, "uuid": "ab3096b7-e3b0-4a9d-be97-c61a02834cc9", "comment": "Malware payload", "value": "9a45a521474c6dec7ee0129e1a5fa273bb9b5eb4cb97562099259b9f4e3ccdcfc08eb5feaada81007438a2e1f695f09e", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "yy-kak-is", "colour": "#3D62EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190864, "uuid": "5863d2a5-c22a-4926-a88f-dccff3911cc3", "value": "T1E7838E586E4894FD2253006AA4D224BDA7394635C4FC357A364BC64EF14CF2CE9B9FE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190864, "uuid": "b1dfa7ad-14c2-4ac1-8af3-6245739d02df", "value": "1536:b5v+qikQY/ao9l3mTDXqJr7IaZOklGlLaNRFTzoYBzgyOAkCq:d+bmio9QT7qJ75okl6eNvJzgyOAkCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776190864, "uuid": "f511cdf0-1c70-4adc-94cb-651f5aa0a3e1", "value": 84964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776190864, "uuid": "000c417a-0410-41fc-80ca-d46c0cb32112", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776190864, "uuid": "4b8a2d3e-1df9-4169-a95a-7fd3b55d99ff", "value": "1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b5f7a5-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147896, "uuid": "7e82b760-1515-43a2-9cca-21b10074b2e6", "comment": "Malware payload", "value": "ba0707ae5d122d2e594cff462e422713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147896, "uuid": "e7f8d4be-f299-4aec-bf64-cb352c62715c", "comment": "Malware payload", "value": "cd7219d7aa99db6647c5519d24e8cdd35e67e39e1f2e55f1099130593dee66f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147896, "uuid": "8f32b4d6-785c-4a13-af4a-d8822ccd8c62", "comment": "Malware payload", "value": "b73ec9761a072ff0cc08f7d8a5905e5baad0660a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147896, "uuid": "53c781f3-e431-4722-bd74-1e98ad384364", "comment": "Malware payload", "value": "ba69fb3454751985328b6baaf1ded918b45c38f5ecaf593b302adbd23f650e1b001df9a0101491ce1f2eebc56262951e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147896, "uuid": "0de0b3d3-d495-4441-8958-7d7f4c5c8166", "value": "T16FA2643DD5E5FDD0C75F12F078AAF7C6019BA7176E1A172CF8C814920B41798ABB9188", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147896, "uuid": "812fde6c-1fa3-4980-84a3-d1a2de789490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147896, "uuid": "81cd40e7-3acf-4b19-9e8d-19079f8c6b6c", "value": "384:Hz57Ngy0RmnD4b1PkuSsjfzLuzKjr6j5l7fKRh2sIhhwQTSN4XUBIyAGHlc0BqY:Hz57Ngy0RK0bFLjWGjrAl7fPsIgQgsUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147896, "uuid": "4a6a1ffd-5241-4634-9128-c4a24ead1e7c", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147896, "uuid": "a4aa482e-7c70-4f66-b293-4e2839da922b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147896, "uuid": "ac60e08c-0b5b-4eac-922d-494355cc36fc", "value": "Abm2026H1GncelFiyatListesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a8153f7-3826-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1776187334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187334, "uuid": "37d9c9ff-1baa-4ec4-ac1c-9c12f8076cb1", "comment": "Malware payload (SalatStealer)", "value": "c551268dac5093eda80cf71d2929a216", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187334, "uuid": "fad5fae6-f39a-4ad8-a611-8b6f9ae654b9", "comment": "Malware payload (SalatStealer)", "value": "cdec3645b22af12a8a3002711023125cb237539c637e12000357534812392ce9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187334, "uuid": "ba30337c-c732-4852-8538-84902f9c5358", "comment": "Malware payload (SalatStealer)", "value": "e485b090b7017a7a5697828deb676087a228b38a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187334, "uuid": "2b19b14d-4b97-4fd9-a0fd-46238c96a121", "comment": "Malware payload (SalatStealer)", "value": "9b9af435788a59682f3457e8d111ec946baed40882971a1184c1f7d56b609def93f5e27cd688e03c668d1c37ae98f168", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187334, "uuid": "cffa6c5f-dce0-44c9-9384-79e77f4b3d02", "value": "T13C3733C4FD804BB8C9BA0B7404BFA71E13A12E19781AFD978E9564A16FF77C31C59806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187334, "uuid": "dd719314-78de-4626-8872-73db1775cb4a", "value": "a018f5f5a2b01ea31c7296ee86024444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187334, "uuid": "6e71ec08-1125-4b40-aa71-06aaf6541f2d", "value": "393216:GfU7wP7RuDGmltbY32M2cd0y6yCeBKHj16kdA4LQRI2BZI6rU:VwP7RzKbQ2MAJecHMkdA4u/BW6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187334, "uuid": "5f6a1aa1-ad45-4e5d-9a62-f137350501f0", "value": 22917120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187334, "uuid": "fb33e95a-3a29-4695-bb69-645f804f7463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187334, "uuid": "e16dfb29-3dff-49f3-8c59-2e76ce9974f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d54aa6-37e3-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1776158395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158395, "uuid": "33e969bf-3d1e-4bc5-ab65-2d66a84de164", "comment": "Malware payload (GuLoader)", "value": "d006a733f96d98ffd71bec2a616e28fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158395, "uuid": "5ef0c152-dd6d-44d4-a219-07d736777fd0", "comment": "Malware payload (GuLoader)", "value": "cdf346d260738deb8cf5f396518e4d6efe4423c6cedcfe959c1454b10a55b08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158395, "uuid": "8c70e7a0-d03d-4c69-b1de-9a20f8ef2819", "comment": "Malware payload (GuLoader)", "value": "1c2c323f7aa3b8ef808edd1cf47989403edc831f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776158395, "uuid": "d7c464ac-f3ef-4ea8-aa55-807d35394b68", "comment": "Malware payload (GuLoader)", "value": "042edf5abcbd3fbadcac12a408e51c8689203fe00453820a47766a2c67541f6df5460fa8349850c4d66095ebea12846f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158395, "uuid": "e40b10a0-3a70-4e09-9814-17991874f33b", "value": "T1D9651253342885C6D7748B394D6AD259ABB37F3C0866A70E31A67E19A1B93731C3F360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158395, "uuid": "dd857d88-45a3-4767-8d4a-69c01a0969c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158395, "uuid": "043aa132-c0ec-4b69-b7f6-dc862e507f98", "value": "24576:rYXcwiDlWUY93m/RhHcSZqCxtMKUCELDR1PCdCnTuMDOXOtQc+7:kXcvkUYlm52DKELD7syTuX6+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776158395, "uuid": "a2f195d8-351e-4cb9-a875-3067761aa0c1", "value": 1512416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776158395, "uuid": "45fbba3e-41b3-404d-be86-7cb94c2912a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776158395, "uuid": "e91b11ef-d582-4486-9f04-19ef5cb70693", "value": "cdf346d260738deb8cf5f396518e4d6efe4423c6cedcfe959c1454b10a55b08a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84eb894-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776195678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195678, "uuid": "62450b77-4bf6-4dec-b704-621fd63a26dd", "comment": "Malware payload (ValleyRAT)", "value": "91d0c701a090a499b5c8bc017e790173", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195678, "uuid": "7e4d5daf-3080-4dd0-82bd-03388d179176", "comment": "Malware payload (ValleyRAT)", "value": "ce9c01332ece503c5f2afc1976aa1f0a4dc8d0eadfa944e729e99a6bd4c08085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195678, "uuid": "b79204c2-f957-472c-801c-f3f0e1a667ff", "comment": "Malware payload (ValleyRAT)", "value": "181f09798b4769987e20f14cf454d0839be3c098", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195678, "uuid": "5ae7f93d-dbc4-44dd-b68d-d3f1282d72c7", "comment": "Malware payload (ValleyRAT)", "value": "fb68d65d5a210e4d784f98291c87cc35e7ee8a84e7186d53ac4e6cbf1bf30347b52f7fcdcde5d2dd8a95085e9a68bbe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195678, "uuid": "67a84c4d-184f-4c45-99b7-9088e586fa1b", "value": "T1BA948C26B9E1C47AC6A341304FD6DB7AB7F4EB644D220E4373D44B1D4FB59428A3B229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195678, "uuid": "e24bcb27-664b-4405-ab26-f15ddbaf4406", "value": "b308d745d256148c8dc654cd96ace50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195678, "uuid": "12d28ed6-c9c3-4ca7-8eb1-1a71f5ccb742", "value": "6144:JlE4NG3kmCKWvMe5pVtPPq6EOftZO2Y7CQ5SuFDmHyX:JlE4NEW0eLDPC6EAtZOZ7Ctu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195678, "uuid": "ad12d671-5a9f-4764-a2f8-e1140e8932dc", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195678, "uuid": "92ec5092-4d17-4c10-964e-41d470387893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195678, "uuid": "907b8b36-4417-45b7-a0fa-278e4e64cfc4", "value": "ce9c01332ece503c5f2afc1976aa1f0a4dc8d0eadfa94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a499d4-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776149602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149602, "uuid": "485728c9-0644-4342-a665-2e6f1b2bca70", "comment": "Malware payload (AsyncRAT)", "value": "217c28ca2d2fb0944c802956c5e465f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149602, "uuid": "28045be4-9a09-42f1-a3f1-acd13190a7e8", "comment": "Malware payload (AsyncRAT)", "value": "cf0a0b5a76c295abf782093be701d0ca4a81fb98399ebd267f3a43686cc0f604", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149602, "uuid": "4425b7d1-21a5-4c25-98e2-4c4ccb36e6a2", "comment": "Malware payload (AsyncRAT)", "value": "bf07214495ae3b8f3c0f8c46aac20668c0b781d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149602, "uuid": "69ded4c0-2b55-4f4e-b0a8-99a4284e5aad", "comment": "Malware payload (AsyncRAT)", "value": "f6f533e4be53c6798196a515cfa01580ec7e0681b0fd09959bd3b2026225b50afbb16c9d7a47dd475537684025378abd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149602, "uuid": "fcbefb5d-ca42-4337-ae48-4d6ce1d5a4cd", "value": "T1CDB569450341A68D6CC252AFF87D2F9E5A8D4A393C3275FE1C3B4FEA85B2512BE71049", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149602, "uuid": "d64ec0ec-aede-4903-b74d-cf14c66baf37", "value": "192:2nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnu:1SKfvHQQEOtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149602, "uuid": "ad61e788-f737-4f74-8b7c-80cf48583f7e", "value": 2487071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149602, "uuid": "5115d6ba-b8ee-4a37-b735-d3147266b397", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149602, "uuid": "0c35f019-d0ea-4be5-a60d-d7ac46d37978", "value": "Nuevo contrato.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc46d60-3807-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776174236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174236, "uuid": "c691175e-ed2b-4ec5-a5ff-ea7a721b5c19", "comment": "Malware payload (ACRStealer)", "value": "a0a8ceb32824464b76ccd44fc046b6fc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174236, "uuid": "be495451-daf6-4059-ad40-3a95bfe6bd83", "comment": "Malware payload (ACRStealer)", "value": "cf8c6a5003c133a7ff979bb5629e0354a11b0297723eea90b1b03e5ead04d6ea", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174236, "uuid": "9ea8f847-fc4a-4d42-a9b8-96b3e021a804", "comment": "Malware payload (ACRStealer)", "value": "dab8311deebb1d355438d3f9b689aebea2d666cc", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174236, "uuid": "6408fe3d-2f3a-4436-951a-812ae914b6a8", "comment": "Malware payload (ACRStealer)", "value": "27c2561f99c82bab3c508ba8e38f3a70729797a7bbde473a41be5bd6545b859f8f5bcb997ee6845c1c27b5664789c235", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "system-latitudeprevalent-cfd", "colour": "#1BF748", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174236, "uuid": "91b8ce8e-9600-433a-ac76-b6290e17718b", "value": "T1CC76AE32B605603AD4F71536A1776A784D3BBE503B269CD756E438CC8F325C22A7A24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174236, "uuid": "516c8c98-0d4b-4387-99fb-0b237969ed5a", "value": "a90609ee973c8ba5f091fd392ba83911", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174236, "uuid": "09cace7b-0262-4846-9d70-848416885b67", "value": "98304:JfTrOoo9MLKbZqoqn6r4FHlMZsky5ZAdsC5ssd1+PkLuwW5ahqQ:JnOoo5RvZXLuwVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174236, "uuid": "05dcc08c-1452-4d91-89fb-214baf1eb317", "value": 7264256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174236, "uuid": "d0bd6684-f90f-48ea-b7cf-6ef1436d8ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174236, "uuid": "42eb668e-ab42-4d06-8b72-7b518122cbc8", "value": "python35.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a12762-3839-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1776195645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195645, "uuid": "1c068b69-bf9a-474b-8a20-478e09b0e83c", "comment": "Malware payload (AsyncRAT)", "value": "578f22590827cf7c937c8cd7ce7f3cfe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195645, "uuid": "b841e5d5-1df2-4625-b809-16b2333783a6", "comment": "Malware payload (AsyncRAT)", "value": "cfc9ac1284b43f2dedcb17c40d51b93147aa7a7f8dcf0e60b7599d5561aa9488", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195645, "uuid": "0615283e-2f5f-4e74-97b2-654ae0759fd7", "comment": "Malware payload (AsyncRAT)", "value": "3ef4d5b64d819debc3337b7a180b573190c2585d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776195645, "uuid": "0b449221-ee4e-445a-905d-8b0ac26676ab", "comment": "Malware payload (AsyncRAT)", "value": "c6b5922de67bf1ec2f68bdd516dbb0cfaf8d53ed06a371c7f2f237c1c6dc4999eb954faa5853eb4bd65e518d76a1d00a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195645, "uuid": "9e167eb9-33ad-4bb5-8ccd-f3a6ba5c9385", "value": "T1F7232B043BE9822BF2BE4F78A8F22145857AF2677503D54A2CD442D75B13FC29A429FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195645, "uuid": "4346b96a-01b4-466e-bdf1-da9abc8da18d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195645, "uuid": "01a93fa1-86cf-4e2e-8503-692711cd9754", "value": "768:suKQ9TH4EjZWUR/ejmo2qrrVbDBvgPIYJQDA4m0bx+fCDAUd2fWNmZbe31roBDZW:suKQ9THfe2+tDBtYJF4pbx+mZduWQbeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776195645, "uuid": "a252752f-d553-4676-b22f-d7dc0de3dffc", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776195645, "uuid": "cc215506-e1a1-4285-945b-058314e75c0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776195645, "uuid": "f0f85707-b040-49a0-a11a-2334611d1c41", "value": "eww.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038a43ab-37cf-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776149768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149768, "uuid": "4aaba408-2567-409f-b0b9-f475707c4c62", "comment": "Malware payload (AgentTesla)", "value": "ed287e31544fbdd4985b0a345c177532", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149768, "uuid": "091ac2c9-869c-457f-be25-84e153b3deda", "comment": "Malware payload (AgentTesla)", "value": "d05f34f96070e283f91e77e93e71d2c7023777247a11f16d9e78dd85ec588eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149768, "uuid": "3ef6122d-e4c7-42a7-8a7c-87ed09ef29e5", "comment": "Malware payload (AgentTesla)", "value": "0ddcb32e62ec86ec68ba75dab76e6131449dd188", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149768, "uuid": "25127094-9246-4be1-ab7c-fc1f2eceb8b4", "comment": "Malware payload (AgentTesla)", "value": "bbc6694eabd4db51cc6005d5b4faf67cca636a538c7f8c3ace891e1217dcea45d53de1ee5de486033d386f9df1cdccfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149768, "uuid": "26910d58-9d4a-4804-b8f3-13679bf6156d", "value": "T10A569508D4A4B20E98D2CF7FD437D4F0498FB96A6E8D8AA2642F907D1D57F93A41058F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149768, "uuid": "660356a3-db2a-4db3-9c76-e91cf732cb0e", "value": "98304:uPOZlQst7kkJNvpgJ+FwVoARgOKc6xfhFT1ZVFkDC2SkjkABfxMlFv6KOFp5DgIv:wOAsCkJFW0FwVb+c6ZTVpxkVJxML7OFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149768, "uuid": "ce883560-8fa7-41c1-9726-a86a6be4b31e", "value": 6195880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149768, "uuid": "db100109-fe49-4759-b791-ff746db721d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149768, "uuid": "a903ae0f-7414-4b42-bc8e-c02b91a8588d", "value": "PO 86438.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50473e88-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776191128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191128, "uuid": "47e9e8fe-75d7-4dfa-81b1-c899a82013b7", "comment": "Malware payload (SnappyClient)", "value": "8022fa2d6145f4592d05ebc10276861e", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191128, "uuid": "bbaa825c-5545-4a56-be29-793318c08f34", "comment": "Malware payload (SnappyClient)", "value": "d0d91ff020800f60ddb2cbded3c79fb9de0fc261e4468fa2a7d283985470bc68", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191128, "uuid": "c4eca854-60c3-462c-87b3-c2f0c0c03ed3", "comment": "Malware payload (SnappyClient)", "value": "a372fa135815f9993671b700316006d9f889cf34", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191128, "uuid": "df40359b-0238-41fa-9401-90adcc71d9a3", "comment": "Malware payload (SnappyClient)", "value": "d5ffbc5d85046a9ae6aeb0c20204f11084a35bd70da0ad2a3c590129accd72fac7fbb1bfa8fc625c692fd6a966996ca7", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191128, "uuid": "6624827b-0870-4d5e-acfa-5a18101d02f6", "value": "T14B553381D3B1C13EC25791F1EB74285EA8AC6A0122711DEB49F723D9576E8C6173B83B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191128, "uuid": "585d8762-de86-4fc5-b379-20b1adc6c84c", "value": "24576:47d0mv45nyMNZLk9HaPtT4I2YIt+ETfH+JK70P+HrgZS438WAu7g7mkdYdY0e0hK:47d0mm3O6PtsIgxvPY9S4jg6kdYK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191128, "uuid": "2e3bc6b1-984b-40f0-ae35-65d47652c895", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191128, "uuid": "1cea5e0d-a9cf-40b3-8737-782ee41920ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191128, "uuid": "016a0f33-b2c2-408a-8b96-58a38a9dcb92", "value": "d0d91ff020800f60ddb2cbded3c79fb9de0fc261e4468fa2a7d283985470bc68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6024b2-37a2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130698, "uuid": "df309939-3166-4e84-991d-1eb4e12c0fc9", "comment": "Malware payload (Mirai)", "value": "bb84bcdfb028eb80fbd98654237fd6ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130698, "uuid": "18b5d1f3-101f-466e-bb46-e5374c1be600", "comment": "Malware payload (Mirai)", "value": "d1a8d4df5c49d6416a4b55f27699fbbbaec07f3bcc2e15e7a38a54d9ea57d1c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130698, "uuid": "9de9966d-50d0-445c-814d-e869fd0e19cd", "comment": "Malware payload (Mirai)", "value": "02e9581215f77387d4e31bf369ef270d79f7092e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130698, "uuid": "834c497a-0b71-4b8c-93b5-cfde09e1c307", "comment": "Malware payload (Mirai)", "value": "58ab218f2161c86286623df80a3cd070bb689d1ae43e4962b1e709d53e59fcda3a565d342cc2f66a0b0d5993c9004cb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130698, "uuid": "58e9ccfe-c2e5-456e-a932-10391839697c", "value": "T13043710ABF650EB7EC6FDD3709A9174524CD651B21A87B3A7D34D81CF20B25B19E38A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130698, "uuid": "2e2daba9-92bd-4211-801e-1a2cc101067f", "value": "768:oLWu89xw1IlGGIunNlWYdMR+e2KvDVuh3w6h12pcS5+46kjU4Z/ej5dIne2el9e2:oLWu8fwgI/kkLg9gzi9S1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130698, "uuid": "eee31a2c-88a6-4d95-b02c-17050daf4e89", "value": 59220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130698, "uuid": "94dbe1ac-1c7d-41ae-8a0c-1fd42ea1b316", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130698, "uuid": "8c74f67a-a8ca-43d9-9431-2853b340859f", "value": "0upmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f804f7c-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1776164981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164981, "uuid": "8bfb255a-7cd0-4d19-9e75-b3105c75118b", "comment": "Malware payload (PhantomStealer)", "value": "df532622c20cbf096d2710a1eabc1d91", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164981, "uuid": "0f6da87c-36df-45f3-98c0-f00d06311db8", "comment": "Malware payload (PhantomStealer)", "value": "d302a5339e89b4630b8b3dd31956d389a22f0cd0193d1631320fc98a4d784465", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164981, "uuid": "71191085-f019-4977-a5e3-17eb432d81a8", "comment": "Malware payload (PhantomStealer)", "value": "da744101a55bacb90c8e8204e9ec93c086842dd9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164981, "uuid": "cb8f3ee8-7705-41f3-965b-3c83e9d093a5", "comment": "Malware payload (PhantomStealer)", "value": "4152ad1edb86df8b0191ec961a60e767cf408cd88d0089a3ae329fad5350839a1b5ed9d35e434b45bd8add144bc64820", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164981, "uuid": "773ee1ee-01fd-4646-8c60-e1076c7b44eb", "value": "T12026021189C83FB5CFEC561D80FE160EA3F04A8E5426798AFB73BD46AFE7904111B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164981, "uuid": "fdfe4ab5-d8ce-4477-b916-235850285218", "value": "49152:1fhDJ2Fvv5gNDrGrnwgIT9P60GVrA++Co2grwvuMp:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164981, "uuid": "67de4e57-8631-4c94-bf2e-7425e4b2830a", "value": 4712910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164981, "uuid": "e7dd570b-1e09-4842-8143-12697d67f9c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164981, "uuid": "4b969512-566e-4db3-8252-2ff086733def", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5977314c-382f-11f1-a769-42010a9c0008", "comment": "Malware payload (SnappyClient)", "timestamp": 1776191144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191144, "uuid": "fd79e572-6d79-4f3a-937b-ea761861ff84", "comment": "Malware payload (SnappyClient)", "value": "9c0a4ed90cdfa3ec00b493c6ab1dc011", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191144, "uuid": "c07c97d2-4732-49eb-a730-18cb17dd4c78", "comment": "Malware payload (SnappyClient)", "value": "d341751caaabee84c53a6c4ce63162a0129469a050f01fd553a35375aaec89c8", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191144, "uuid": "b667c7c2-d9bc-448b-9b1b-02760290c4e4", "comment": "Malware payload (SnappyClient)", "value": "7271daf85cb6254d3ed3a0407ad2e8be556c3ae0", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191144, "uuid": "707884c1-7cfb-4c17-bc55-a6a5b22679da", "comment": "Malware payload (SnappyClient)", "value": "8e621ed4d72671ccd3235c170216d87165df172fef4b656fca7c38f0c9ab52a23b7df7120c470652d6cb8f8f4307d0ba", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191144, "uuid": "8cc69d5d-a534-411c-97f4-42f748dd7779", "value": "T1BD862332E4554036E6F24273ED28A1347E7CA338636488A9E7C4ED1D7AAC4916BF7353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191144, "uuid": "c3e75cfd-d02a-4949-8803-0110c57f9edc", "value": "d7e2fd259780271687ffca462b9e69b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191144, "uuid": "e1f36338-ba35-4a12-bdfd-4b64bf4cfb66", "value": "196608:sfUMWsVC9yy+3ql1ezAAHT67q2eSTLUS4EFdoa:8NWkzzAbneQDdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191144, "uuid": "5537d43c-fa90-43d7-b292-aac14e36c235", "value": 7967708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191144, "uuid": "020ecf75-f2f4-4b94-b60a-7d5ca2cfc8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191144, "uuid": "6c727ce1-d3e4-41a9-a0df-737095805bc8", "value": "d341751caaabee84c53a6c4ce63162a0129469a050f01fd553a35375aaec89c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4a4089-37f9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776168113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776168113, "uuid": "48dd60b7-bcaf-4156-a5b1-f534067e859b", "comment": "Malware payload", "value": "5def92024e1c7d83e9298a391717c43d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776168113, "uuid": "8db4b7fa-509a-4725-a0e6-1e99c2046e21", "comment": "Malware payload", "value": "d3675e1a6a02a52e9afa3c6742e6db05f9c2c937a26667f923f8579c83324246", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776168113, "uuid": "0cf1c2bd-d9e0-4f7f-ba81-c63c05fffc5e", "comment": "Malware payload", "value": "55128716dda0243bcf1564e3d57fab20ae69bccc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776168113, "uuid": "a330f3a5-a73b-4791-b4aa-141b9b58bc8b", "comment": "Malware payload", "value": "c8594e0ee278d6c7fa80679a1f624933502ceecaa980bdcb3efce647364593dc1865c5b45f1585dcb967f901a40c0b6a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776168113, "uuid": "bd8fa059-d400-4b32-aedb-21cfc485d762", "value": "T1B4C74A97FBC49D6AC4F753B14835A3612907AC308F539A879904367C68BB6D03F89EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776168113, "uuid": "8b01fade-67d6-43e9-b9d9-e3ed5f8a9187", "value": "24576:uGdVzgde+PCbukaSuuDRg+IL3cdQmq2ge9yW881QtqIKoL5G:ua2de+PCb+SBMMFq2ge9ZCKow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776168113, "uuid": "a4a3f522-dfbc-4b74-92cd-9af1c95f4d58", "value": 54393560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776168113, "uuid": "89d3b073-1d60-46cf-be61-8690681950b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776168113, "uuid": "b44d4b57-31a8-4b1b-8f2e-ad11ae506d56", "value": "output_0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9c13ac-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776162349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162349, "uuid": "5b726050-5121-42bf-93b1-9582d1a4c666", "comment": "Malware payload (Formbook)", "value": "fda17173fcf019fe9c52a1669bfb2518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162349, "uuid": "0be7029b-118e-4eca-8ce8-286bec371c64", "comment": "Malware payload (Formbook)", "value": "d4b8fe07ff85c9a4cdaa1c078a9447c6e896008579c42ac9dad0d9c1ad02569a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162349, "uuid": "f933c206-8503-4723-a8de-820d6397dcad", "comment": "Malware payload (Formbook)", "value": "228ce8a1ee72a2d756562217535a4401b74ea7ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162349, "uuid": "0aae5f4d-37e3-4e34-acd6-2a35e56252f4", "comment": "Malware payload (Formbook)", "value": "29afb0c79e7343deef01a032f99a1bb7a36e9c00f23e7a24d5d454b2dc719b6459c291e5e2457b1b262232f911e83822", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162349, "uuid": "6a60ae69-d3ad-4f7a-a819-94ce77b2a082", "value": "T1D1351254A21FD80BC05B0BB919F9D27017B88E98D522D54B8FCF7DABB43A76945CA303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162349, "uuid": "31e98427-2db8-45a8-afbd-8ef7fed14d1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162349, "uuid": "c64fe82b-beb7-4b0d-ad39-874ce6df2f5a", "value": "12288:MOLqwhbgboYscKXI7mOijriR5lDFKCnNaDgqbAjUQYdF1GiVZjMPaf0QtY1i1GfX:LXDXQmVeRv8sJYdF1VYPae1iQuO9Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162349, "uuid": "ec0ce4c6-fc3c-4bcb-bff5-a7acaa4891bf", "value": 1118720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162349, "uuid": "ca552ada-a1c5-414e-b8ac-483b9f29c69d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162349, "uuid": "f9aeea6a-2610-409a-94b1-28113c42010b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.20355.26618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a582ff3b-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776175380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175380, "uuid": "513b2ef3-a7a0-4a0f-b61f-077432863ff3", "comment": "Malware payload (QuasarRAT)", "value": "b4bf8d61f17bd29716d4fe3f993f08ed", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175380, "uuid": "5cfc0437-b495-4423-b051-a46c1935f2f8", "comment": "Malware payload (QuasarRAT)", "value": "d6a46b51dae39f549563ebe0b5ea1ae70082dc26385b45d661ad6bfca384cc8d", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175380, "uuid": "9f98f8f6-ed6a-4627-9b4a-c9aa36c6fd37", "comment": "Malware payload (QuasarRAT)", "value": "00e44e8bcf2097c71f73853825c4039a5cb155e6", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175380, "uuid": "02709209-ce38-4365-b7d9-f5b9a550e56d", "comment": "Malware payload (QuasarRAT)", "value": "d68d715eaca5e78c4ff02fde8ad6e9158f9faab1b95ac76ae21fb82139ee67c7902d10aad8ed9c2952825fb3d824d82d", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175380, "uuid": "0391e2aa-eb56-46a2-ac5a-407e7fb664ea", "value": "T10BE56B1037F85E23E57FE6B2D5B1002267F1F82AB363E70B698167791C57B5088426BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175380, "uuid": "46bb253e-8670-419c-8b0d-c829394acfc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175380, "uuid": "189ee7bd-6275-4c95-9c53-8497987ce265", "value": "49152:fnxndotKb3kpiRlkfFBera0WrxoF4HHB72eh2NT:fnxGtKb3kpiR2fFEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175380, "uuid": "6a412eb2-b217-4e62-b4d0-fdbcce236ae2", "value": 3269632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175380, "uuid": "dfa648d6-15f9-448e-b407-61b9b61bded0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175380, "uuid": "fb15e75f-8a22-4e55-8a90-dc67c32187cf", "value": "aIg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bae831-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127221, "uuid": "73d487a8-8c22-445d-b47f-d8d12f992167", "comment": "Malware payload (Mirai)", "value": "067db6bdd2a7b2fb8101f5ce9d6238c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127221, "uuid": "4b6bf855-cb46-4257-bfa6-7d568ee03718", "comment": "Malware payload (Mirai)", "value": "d6f9855920fbb203bb5afed6d5ae80f86dd1b56b10d7fab4e51ee98c2fb5d72d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127221, "uuid": "e87acb48-3173-470b-97b1-1e79247832f3", "comment": "Malware payload (Mirai)", "value": "2058ccce68818c7e79da2ac21a5145aace9ef1c4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127221, "uuid": "53ba6c52-83b9-4f18-a1b8-f666c6661119", "comment": "Malware payload (Mirai)", "value": "9f35009d6ef7d0da92b6480061981417c6bdd55b64e4a09de15a4dc603cf8f27a33738584a805a9e8db0e3187dc640f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127221, "uuid": "9ed3e819-1a6f-4162-806a-53f614bbde01", "value": "T1FB447E137B484DFFC92EC7B15EEBA3208A13F0350B27A79B37506A952F4B1985E94318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127221, "uuid": "48bd5933-fbd0-4ee1-ba09-145c619780bf", "value": "3072:DpdLyu35RUn1ulERwjcRBPZZJgBjbkxZ+f0W3YehOwh+U1p4hjLMVZVhePVrp:fbUn1OcdSg+vhOS6jLMVZVhePVrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127221, "uuid": "8c70b952-9410-40cf-bbae-9b547e8bb090", "value": 261372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127221, "uuid": "d46bd1a0-4ffa-41ef-8dd0-2c2733bd5c49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127221, "uuid": "ab8b6e5f-f267-45f9-86ce-608eda336ee6", "value": "zyre.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041cdc98-37c9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147192, "uuid": "cb6fd07f-c7f1-480c-92ed-9b1466634fb7", "comment": "Malware payload", "value": "f7f498b839e1695f6c76020379f7025b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147192, "uuid": "e67a015a-bca2-4daf-901e-ef175c6c99a2", "comment": "Malware payload", "value": "d732d74d526a82a23b17af67567c6f6693475d932c4c9b28e49bc8355aa3d428", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147192, "uuid": "14b3da21-73a5-4a67-88df-005f19c1826e", "comment": "Malware payload", "value": "01466e4973aef80a106a2589e871abeeb6ece822", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147192, "uuid": "890693fc-42f8-4198-ac1a-e25da20ca30d", "comment": "Malware payload", "value": "90b38f39635da3c43a2b3e549c077020922585a58174389b0b1d52b85272e08a70ba1ace94abfb92eb719b788c62d20c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147192, "uuid": "f2590d97-42d0-48a3-8dd8-9ec4364d4092", "value": "T1D3136D6526953C25AE99883B5D7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147192, "uuid": "3f6d53c0-f72a-4e44-b735-8b66c75f2b28", "value": "768:bjs9NyXsZztCz9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:boHusZVcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147192, "uuid": "2c1fedf8-7396-4a8a-81e3-4944cc87b745", "value": 45523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147192, "uuid": "e870770e-72c2-4ce5-8f54-3d41f6e593fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147192, "uuid": "f366f856-96ee-4d71-a9b4-116de75c6619", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4dbf0bc-37f0-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomRAT)", "timestamp": 1776164239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164239, "uuid": "c43f9f64-307b-46c1-87d6-2e89baa1ee02", "comment": "Malware payload (VenomRAT)", "value": "518012e9cbb29d2c1b227064c5663cf7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164239, "uuid": "fbaa3769-ae4f-4c94-bb5d-7b4949587ada", "comment": "Malware payload (VenomRAT)", "value": "d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164239, "uuid": "51482945-7e75-4b55-9dd5-d60f13df2df0", "comment": "Malware payload (VenomRAT)", "value": "633dbe33f6ea8bff9f2882fa5c49b61e36c40afc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164239, "uuid": "958f8e68-a840-4a3c-bf53-2b4001d66621", "comment": "Malware payload (VenomRAT)", "value": "ac009cb86ba91365b533b755dc01c01a7de58b786d15b0db66acff22005f35c6af2e2e867ab5e69dbf13aa8c60fcdb8f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164239, "uuid": "8b83c412-d260-4123-8ab2-fc18b17ba9e0", "value": "T13A345B3DD9A80016E1B6DA14FDA60413E5777B132A3D8C9C22C5128D47B350EB9BEB9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164239, "uuid": "91c5407a-7b34-45ac-a9ee-a45e3161b416", "value": "6144:M3XPuKQVyKpCdBuFQ2i4yTMwCtvZBhMygBqFp0XXF4hDL+2d:MnCohdBN2xp/uML0XX8DLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164239, "uuid": "376ce566-df04-41cd-8f9f-d902996dacf0", "value": 235190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164239, "uuid": "76d610c7-f96a-404c-b9bb-3268889e18e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164239, "uuid": "153aeb23-64f4-4005-934b-2fa72086c055", "value": "Invoice_PaymentProcessing_INV-26041420-001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccead264-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776152683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152683, "uuid": "447684f2-c02e-4770-8caf-df182ccbbed9", "comment": "Malware payload (QuasarRAT)", "value": "915fcd5a462c38428f6f0306995f3730", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152683, "uuid": "b818a04d-3acc-4a4a-89fe-056ddd47610e", "comment": "Malware payload (QuasarRAT)", "value": "d856336054b054ee4b6aed66226e90dfca9a236e93012360b34001e75cf58693", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152683, "uuid": "dd2b250c-40c6-4912-b876-02a2638a3c8c", "comment": "Malware payload (QuasarRAT)", "value": "56fde32c8a689cfac8aea7212e5402f555002f97", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152683, "uuid": "dd03b26e-0c67-4b6f-9c71-729fe582235f", "comment": "Malware payload (QuasarRAT)", "value": "549f332774e2fa63994dcea384f0002b8e4a1041d1f4a8b122bf2604a3d00b202b29969679dc85f284b1dccbcfb69903", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152683, "uuid": "c796df12-4187-40ea-b0ed-3076fe30b299", "value": "T17065021589C42FB5CFEC5A1890FE171E63F04A8E552AB54EEB33BD4AAFE7504020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152683, "uuid": "bf666e9f-decf-4879-8a45-3ba2857a87c5", "value": "12288:XHBcercT2rqqcCx74BplUQ50ZHabkg2f8M2MzXhhtobe1Q9Zd3gTSHHzV5d5Lsxb:3Ce/z4pFeHTh2KdduLfHzf/mxbdI7Izd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152683, "uuid": "af9dc59f-6363-41f6-8ed5-6b24fd823910", "value": 1418394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152683, "uuid": "05a5fe55-e241-45e4-bdc2-82c4f6848723", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152683, "uuid": "ecfc5463-ecdc-461b-bed2-4805a8b15f5a", "value": "WindowsLogonService.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f0a9b8-37f0-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1776164339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164339, "uuid": "8645296f-f914-4065-bfe6-9e72dfeb35f8", "comment": "Malware payload (MassLogger)", "value": "77268d07d8814a32906d70862360f23f", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164339, "uuid": "3b845550-3847-4bcd-96c6-480e2c2bc557", "comment": "Malware payload (MassLogger)", "value": "d871919b2e1d1ddd764bfbd7213cff8da7091d9238c12ceade5fae06d687a146", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164339, "uuid": "429cee12-26ac-43ec-a80d-46d3e03b2045", "comment": "Malware payload (MassLogger)", "value": "6abdffc6ce21d30051174dc072436f343736beb8", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164339, "uuid": "0b7e1946-49a2-464e-9254-c22f19e99e2c", "comment": "Malware payload (MassLogger)", "value": "a0287c796f7599367e71e04280df35b946b52e920d69057895553761862ee89db58a0748efda2870c9661b5032726df3", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164339, "uuid": "1b7252f4-61c4-4c61-b115-b7f5f99e19e5", "value": "T158B22E3EC985DFF00B6A31E1A65F7A1598141363B4382E4DB8CEC1993B39654CBB50ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164339, "uuid": "df627a76-953f-469c-819d-afa6ecf4b787", "value": "384:KW8ZivgIJ0tTjcJG+1BbOMAn7hcMDBT+k5HRH5ZcWy36Sfm0THLL/DrFcYjHPUGt:KW8Ziitsv+GcxTsKSj2emK1lzd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164339, "uuid": "aa4931bc-5384-4fad-b607-d5d62f2b242b", "value": 24112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164339, "uuid": "9b23b9af-1696-44ff-81b2-01c5578bd815", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164339, "uuid": "bb6a4843-1b21-41d2-8f0e-7f3685bb1a57", "value": "royy6453201.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b406c66-3809-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776174691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174691, "uuid": "644d9db4-73e9-41c5-b75b-bb543187da50", "comment": "Malware payload (LummaStealer)", "value": "7ced0ebdd1b82ed4de81ec6b35184a7f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174691, "uuid": "91a0d4fa-7c8f-4fdd-bfd7-4cccdcd1aeda", "comment": "Malware payload (LummaStealer)", "value": "d899286d09509b9a41d09b310c175caae46497fb2922987cc739ec1047c9f579", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174691, "uuid": "cc3662e1-5748-4607-adf0-b293fcccf5b5", "comment": "Malware payload (LummaStealer)", "value": "802cc0e1e7c7272529a38ea582d72ee4958b5a03", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174691, "uuid": "f224a1d5-c90a-4b87-a510-71ae6c84cca2", "comment": "Malware payload (LummaStealer)", "value": "94d549eecbe4b52f563b80d5ddab50adbd65387b13d116bac5fcbcc6ddc444add6edc0bbba7edc5a682eb79bb6d25838", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "mn-manicottiearring-cfd", "colour": "#4234CD", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "RenPyLoader", "colour": "#CB1557", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174691, "uuid": "be9abdab-2c6f-4c13-9be3-7be03e91c22e", "value": "T1596733EC831D9041F393FAF8706F415ED27556A23AF896DB2B7526A43DD32421E3630A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174691, "uuid": "fe5cd7fa-1ab9-4c90-b592-4a47bdac9685", "value": "786432:DBfpC1BW72hKVkFSYFcQrZ5kewv2pqLmq1:DvC1S5kFSvswv2p2r1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174691, "uuid": "c0adff5d-c138-4033-aea1-2b972037df7d", "value": 32092479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174691, "uuid": "7e5632d9-d8aa-47e6-b3a1-714464de4e32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174691, "uuid": "b8be6628-e700-4d78-b794-80fae21a8f9e", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aaec57d-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776164973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164973, "uuid": "50592686-6ab3-4570-8940-69438d277d87", "comment": "Malware payload (Formbook)", "value": "bd98fc7988e591571092b4073dac40f0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164973, "uuid": "74fc2caa-fb31-4086-9111-22cc90117e2a", "comment": "Malware payload (Formbook)", "value": "d9331017aa26e6ed9c3265c586b931dabd089d94eece0b968039393642b16b78", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164973, "uuid": "217710e9-bce7-4761-a50d-c9f8ccdff7e4", "comment": "Malware payload (Formbook)", "value": "54ce7d7db25d0984f0e322479dd0588431f5df1a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164973, "uuid": "a86ba2b9-0bfa-47c4-b39e-ad70ed21f82a", "comment": "Malware payload (Formbook)", "value": "8f5e7e4cd07292265167d14896bc10ba90870a31296b9d0c58f4cd34f48783c6036c99d67e0408e2ff3404b727c95e4d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164973, "uuid": "304b0b0c-8ee4-4385-91ba-7ab52e0fd8b1", "value": "T10C95022189C82FB9CF98561940FE151EA3F00E8E506A75CAFB73FD4AFFAB6044117499", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164973, "uuid": "a14e10b0-1e93-4c3b-bea4-ef00254df5e0", "value": "24576:qpMCuPxTCDurk1YMN2PFx1/A+60XkL6u+alEFP+1lJXGseBKUUYOw0ZiiQ:USJTr2Yq9DmUDXib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164973, "uuid": "0edec6cb-b23f-40be-8e26-5843f137c535", "value": 2050771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164973, "uuid": "05211066-1d74-498a-b4e9-04bcfa6387c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164973, "uuid": "afe1e027-0d08-4b88-a49e-3e442c36e2d8", "value": "Nuovo elenco ordini.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2e9680-3825-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1776186778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186778, "uuid": "18c395e7-321c-4085-9309-de6525c9c42e", "comment": "Malware payload (DiscordRAT)", "value": "95131b6be8b73ef20bda266a2ff193f9", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186778, "uuid": "cb9557e7-9bef-4fb3-a0b2-da41059b6b8e", "comment": "Malware payload (DiscordRAT)", "value": "dbdeed3080cd1b935ca88c373f35773ba155fda38738f4808804aa90d22c71b0", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186778, "uuid": "4a84a8b2-b8d1-4017-a71b-fdc00649b047", "comment": "Malware payload (DiscordRAT)", "value": "b0314b1fa0ae07773164beadcfbd6f085d44d63a", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776186778, "uuid": "1cb1f64d-ad2a-456f-9af1-ba7b54fcb55d", "comment": "Malware payload (DiscordRAT)", "value": "9117a7b47f8808215e78bdebe68eb8c8ca1ea8acad7ea89b087e33ff0a3e8dd2c5823fd8631e6429fabe46f51c023650", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186778, "uuid": "22a282a7-78ed-4061-8764-32dfd992beb4", "value": "T19773B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186778, "uuid": "bf33b00e-ccfa-4152-bff7-c3d21ccb802e", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+wPIC:5Zv5PDwbjNrmAE+0IC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776186778, "uuid": "8ab2296f-4216-48ed-ad6d-a7b15f3b311f", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776186778, "uuid": "4d483441-9ebc-42c4-b1dc-ba3394d4d45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776186778, "uuid": "a01ed6f5-926b-4862-935f-0045690f40ea", "value": "RedTiger-Tools-main-2.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad105fe3-37ca-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776147905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147905, "uuid": "3d3569a7-5ebc-4234-9045-e24e4759eefa", "comment": "Malware payload", "value": "ec2838191bbfcb0e1f34bfd7a284fbb2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147905, "uuid": "ca66de41-24ca-4e30-880a-2c8129f65765", "comment": "Malware payload", "value": "dcb35341363737afeb2ba60a3396b33a11272b2761625dbdc14a541f9bb23179", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147905, "uuid": "1869189f-6a27-4cf3-a5be-86b915ed03af", "comment": "Malware payload", "value": "29640fa74148367dc8d4f4c3fcfd6fcfdcaf3e37", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776147905, "uuid": "08e96216-21f4-4fde-80dd-a272634f8f57", "comment": "Malware payload", "value": "70f7a1e69630bfe0919076d797d7680d81618b65be3f38a127473659e8da76380520f47153d712fa9f5cdd5873f6f1fa", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147905, "uuid": "043fbd29-62af-450e-b7cf-27d58f9162af", "value": "T10A3111111BF20329EAF74F36D8BA6212A635790BEB219F4F0194155894B0121E8A6F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147905, "uuid": "c0142808-be4b-49c5-9016-c6592634a1aa", "value": "48:88TomeKpUQfrrOUQKI334wfUIA6q6Cax:88cOCgrrFI334wfUl6q6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776147905, "uuid": "6eabcb71-e941-40be-b951-fa96d18c0a06", "value": 1857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776147905, "uuid": "f4a60d16-960e-43dc-966b-08887710c3ff", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776147905, "uuid": "504ec518-ca4e-4726-a6d8-fe4cfab5911b", "value": "IMG-777703874.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433bbd02-3820-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776184664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184664, "uuid": "a6c1d1dc-d143-4e4b-9d06-59156b8ccde6", "comment": "Malware payload", "value": "edc5800017dd5abdb8d575b153b2dcf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184664, "uuid": "5fd6e18f-6a11-4b55-8547-7c6ecc1cd286", "comment": "Malware payload", "value": "df9571b999cf42158d771e5a091c0268c2e5da09756151ebfe3adefdd50a4727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184664, "uuid": "b59f1cd7-405a-42f3-9163-190dda49dc1c", "comment": "Malware payload", "value": "b570a974680f066a8cca0904a0b7f77184a0601c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184664, "uuid": "8cccbe65-c6ee-4021-b391-ef05b2ab8e9c", "comment": "Malware payload", "value": "7b5f954c3d276ce8612da8700f75a7806ed9ddab47d59d5801b52ff4c5fa3cf03ed381069d88e53da3774a3dd2543cab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184664, "uuid": "efccb01c-310a-4e4e-90b7-52b32c525700", "value": "T163442A3ECAA90016A1B3D624FDA50413F5777F63263D8C9822C6128D47B350E75ADBAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184664, "uuid": "be28e683-71f5-41eb-a75f-81833f869335", "value": "6144:NyOBs8fg99tLwmZ7ApWxgFwb9AjWT+Xft3Fyp4UOTLuO3i7fNZfpK:VuQe9xZ3GaeqOypnO/uL71fK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184664, "uuid": "d226f1b3-3309-44b0-b124-6e0a2cbf5bc5", "value": 254430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184664, "uuid": "e92ffbd7-3720-400b-836c-7bd1d56f2ed8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184664, "uuid": "46ba749b-9ac0-4403-ab51-91be495edad6", "value": "New PO for MAR.-TCO-AIM240204A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1644c2-3843-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776199761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199761, "uuid": "09a91208-5d5d-4a11-b7f5-65b6386cea7f", "comment": "Malware payload (ValleyRAT)", "value": "f4927bafd9ec92e2efcf0b44ad56af98", "object_relation": "md5", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199761, "uuid": "876e7801-7bba-417b-bf94-01628fee6c4a", "comment": "Malware payload (ValleyRAT)", "value": "dfb59fcee8102cd4055b29396a0a3b3d7d23c113b94ac37517ad24038b50e7ca", "object_relation": "sha256", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199761, "uuid": "3a41ae52-7542-4d78-893b-dd3f41485443", "comment": "Malware payload (ValleyRAT)", "value": "fb9716c0dcba132d2f16830c479a40eecc1ec910", "object_relation": "sha1", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199761, "uuid": "ed693ad0-9468-4415-9427-991619c8d647", "comment": "Malware payload (ValleyRAT)", "value": "60ce913593684140a7f07d3b30883e59d9d702f8cb15e15cfeba912ad3cd37f21bc6706ed9e5a0b39bdd0ace7c5233fa", "object_relation": "sha3-384", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199761, "uuid": "38f842cc-fd0d-452e-b53f-f3a667160647", "value": "T1780833D5301A4965D87BA033BD42EA88BEF84DCD501ADF29CB52EE7C09911E1F07BD1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199761, "uuid": "4e724ea9-4852-4596-9731-bd54f5a759ac", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199761, "uuid": "2b1b22dc-044d-44d6-958c-513baf59f5be", "value": "1572864:n7bQ18HYZ9yF3KrcJN4mo/KBV9ggLwiUQxdvtPWVOCmW3HjRqYb:nP/4Z03ecYmoCWdiUQxdF8X3km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776199761, "uuid": "e2e9503f-641c-425f-a674-ee1d7e0cec60", "value": 78525783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776199761, "uuid": "ebe4cfa9-1adc-4eff-86d9-abd241e8a8d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199761, "uuid": "72e63d85-c3f1-4bc8-a6ff-f7da3b8ecfff", "value": "Letslat2.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82193191-3808-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1776174461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174461, "uuid": "3d4a415d-a143-40dd-acd1-131f102a597f", "comment": "Malware payload (LummaStealer)", "value": "759919294960e53cc705f3bf1292b348", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4169", "colour": "#CA73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174461, "uuid": "9b8fe13d-f4fd-4983-ac0f-6458b7787ef5", "comment": "Malware payload (LummaStealer)", "value": "e0172711809e4df7a177bd07c8054c47939e4ef5e8b6adc2dbd11ff9374d9d11", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4169", "colour": "#CA73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174461, "uuid": "8ba913ba-849f-4a01-bccf-b140bf4dabd1", "comment": "Malware payload (LummaStealer)", "value": "21066d4f1af54fbfdc071caf0b7f8f619afe64b4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4169", "colour": "#CA73EF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776174461, "uuid": "7b2ce5fe-928b-4c66-9b5b-a2e4de36e449", "comment": "Malware payload (LummaStealer)", "value": "336d047827fd5276d39d0b58258078e87d7f828b3641c8eeb48c5ab270a47e8e97fd4c2fc7eb974b8cb2bd82702c9310", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msgrouppolicy-vg", "colour": "#214885", "exportable": true, "hide_tag": false }, { "name": "pw-4169", "colour": "#CA73EF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174461, "uuid": "d781d019-3d00-42b5-ac87-4cb318d58c6f", "value": "T1B10733ABFDCDB79C27D4FC5901177E9B0570C3E8090814807CED1926B6E74A6CEEAA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174461, "uuid": "4e639612-506a-48dd-a23f-c8d50dc01350", "value": "393216:/Jl5Z051WSit8Ef6M1o6+iOmJmW2FakaFaK0zJmy/3YiEY6vLW:Bl5ZUgSit8EfZiiFtaaFaK017/k7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776174461, "uuid": "a7f98eba-a9f5-4440-935b-9bccd3c9e3d2", "value": 17926467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776174461, "uuid": "247078c8-0f97-458c-81e3-8a6be1c1dca7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776174461, "uuid": "a535ce10-15c1-4eb1-ab14-81684157d724", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f5a977-37c7-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1776146609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146609, "uuid": "48b46a14-1235-4a5b-8926-d17119b11d35", "comment": "Malware payload (ACRStealer)", "value": "0f072c0d790940e34d4021c33de0bb24", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146609, "uuid": "7b185190-b607-45b6-b5e1-da2a2be4a10e", "comment": "Malware payload (ACRStealer)", "value": "e11885e11d0c30af6d787e1b70203b964cae1b4618bb9a430a8d6ce6c99f0ac8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146609, "uuid": "5022361f-f027-4527-9b80-a0ad1673752e", "comment": "Malware payload (ACRStealer)", "value": "669c1d101e122e64e37fb26a0e279e0a67da2c80", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146609, "uuid": "4d5b94d5-c2e5-4456-bf49-0ed0dcc3b00a", "comment": "Malware payload (ACRStealer)", "value": "2d35bf4b3764d85ec77b6b96ac137b8f7b1e9f4e15fa1b6d36124dfa7e6d052ce25c9a249b1ed9a22b0d1ca00c3bc7d4", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146609, "uuid": "af3d1e89-a7fb-461f-9768-cf0438807fab", "value": "T1B246BF55EB8744F1ED5748B08147FB7F9B31EE02C520CDAADA58FD89EE33A62101D226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146609, "uuid": "1f7fe208-83f4-419a-9454-bf0f3c85b8a2", "value": "492a5d3560401c2811de048088bf91d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146609, "uuid": "c1301436-34d7-48b0-a3c5-ac959b2c4d9f", "value": "98304:gCgqXdZGmkwmh0aOaebj+MrBhO4k8mc/LCw0Fo/M6TKHBAUZLXaI:HXdMmvmKFNb6M9hO4k8mc/LVN/8HVr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776146609, "uuid": "c5f90d6f-32b6-4eb9-a678-e27480c50d74", "value": 5608189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776146609, "uuid": "c49c8283-d640-4abd-8527-e0809da99b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146609, "uuid": "ab3d725c-f787-460b-a1c1-2045d0f2552a", "value": "0f072c0d790940e34d4021c33de0bb24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82f5d65-3827-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776187974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187974, "uuid": "4afef73c-3a22-4e83-aba1-9b39a00bcd12", "comment": "Malware payload", "value": "3377e615c001548bee24d8e5ca1909b0", "object_relation": "md5", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187974, "uuid": "197a9002-d6d6-4a2f-860c-c52ed2bb0f01", "comment": "Malware payload", "value": "e226ad9057d1241cee7c084f8c80d8f0a83b14444ad5057b916a1a7fd26ba64a", "object_relation": "sha256", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187974, "uuid": "c06dab60-24e3-4180-993f-e4d36aa66120", "comment": "Malware payload", "value": "766a22174c644f6e21f73ab4445e6a4b7fb4ad41", "object_relation": "sha1", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776187974, "uuid": "4d820de2-de80-4b18-a796-660d317dd2d4", "comment": "Malware payload", "value": "5a91659418e9aa97f1257dc3109192d26c201c49e51ced6e0cd2680b35c791946305ee13e89ee8df1c5d7d8e7040e0ae", "object_relation": "sha3-384", "Tag": [ { "name": "187-77-255-35", "colour": "#8788C9", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "consorciochevolet-shop", "colour": "#CC532E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pay-hostingshared99-com", "colour": "#8E98AC", "exportable": true, "hide_tag": false }, { "name": "paymentsv2-mysynology-net", "colour": "#1E2CDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187974, "uuid": "a066d895-5e4d-4ef1-8068-92cdfbd357bf", "value": "T1C4F6333721C5BE77C2E5FBF27D066056A69C887A198133B1D03F0EE9068B60E97E1752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187974, "uuid": "e0f19ebd-bfa0-426a-aaf8-86954bc4049a", "value": "c59df8426685a30598ce303593c3111b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187974, "uuid": "4a3cca61-3880-4a78-88ac-07a50f135738", "value": "393216:0BSp08y0n819cFzJW7R+xJhQFoUvwwTU30vnj/DhcQp:0YpByQ819cF9GQo3LPHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776187974, "uuid": "e3e20141-07c3-43c5-bbeb-8608e490dd8a", "value": 16485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776187974, "uuid": "d8c2e3b4-5000-445d-8101-543c39c2eb01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776187974, "uuid": "8432fc66-edff-4d08-99d0-cad3bf1901b9", "value": "crshhndl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d27c456-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127208, "uuid": "058bbb8d-2456-4c82-ba39-ce3401f408eb", "comment": "Malware payload (Mirai)", "value": "2cbc1fef2ff1a85b030098f47f31aa47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127208, "uuid": "e94fcac5-a6de-432e-a15b-71919bef6764", "comment": "Malware payload (Mirai)", "value": "e2f85b84d420f49fce2ef958987e07cf44f32b295ee41640e3cd54226b5aab6e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127208, "uuid": "1f5e5974-3a7f-4bff-9b53-7d34834e1239", "comment": "Malware payload (Mirai)", "value": "169a9639f6f55c0c99fe65ac1d5db3f6b9a0b275", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127208, "uuid": "aea0d7ce-f932-4de1-9868-69e763d7549d", "comment": "Malware payload (Mirai)", "value": "1a5d3fa9cbcb9b9d2be8710651f85c7cb5f07dcec91101ed28dffd9565a8e9be2dd418919c045a0a1f605bfafd41ea3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127208, "uuid": "757320b5-4759-4560-9d59-89f563063b15", "value": "T17AC3F702BF614FABD82FDD7345EA0B12388C6D5626B52B75B934ED18B71A1C706E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127208, "uuid": "90191006-6c17-440d-93c9-9c740f45d23c", "value": "1536:EXqafQYb1rFtRn/zGGZ6qEMZvhCDRW5FTVg4nedXzcrA+TyTVcdqmthUlgHq:Cq+QYFn/zblNV1e5x+DhPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127208, "uuid": "2bbccfd8-153e-4799-b020-57988dd81365", "value": 120920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127208, "uuid": "b3650e66-16fd-4820-aaa0-dce21ccb8058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127208, "uuid": "812ea5f7-7bd9-4463-b495-325fb9cb187f", "value": "zyre.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f936db-37f1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776164373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164373, "uuid": "52ca49ea-072c-4c6d-a919-ff1f36dd8cbb", "comment": "Malware payload (PureHVNC)", "value": "93b63555024933e9c38341e6e22f6d71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164373, "uuid": "97332b76-9095-4b9b-ae74-1014de39c9da", "comment": "Malware payload (PureHVNC)", "value": "e41deed705816049cd715c481c0703ccb9a26643275f1f07e653a85f0844d1b9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164373, "uuid": "f2797ced-f61b-478b-b048-69242ea5b8e4", "comment": "Malware payload (PureHVNC)", "value": "5e3718af4363dad98455cc4d378e18a7d08db4fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776164373, "uuid": "01da6d62-3f1e-4882-a202-7424f10a9323", "comment": "Malware payload (PureHVNC)", "value": "b21b6901cdc69ef89f4fe4ccf39d12c38e257ece6c12abbd6a0ed66c28f0836da4c4758b9d5deb631846e9c5afabcaec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164373, "uuid": "4cce29c6-a7e4-4dc9-91ae-21c781256af8", "value": "T1DD543238ADEA101AB1B3EF14AFE47493E95FBB63370E985D1081034A4723945EDE563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164373, "uuid": "4c9da6d2-c875-4c92-adbe-21d5d09e82cb", "value": "6144:0ski1klXKKhH1BC8fDymWyTsSBEbTmP+ph3B5TVSePa0g8NEx2ewrcwy3tdtCnO+:3ki1kFKCHTC8fDymWyTsS+bw+HBNVa83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776164373, "uuid": "4202c40a-af3c-4e84-868f-5d14b0706b29", "value": 304556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776164373, "uuid": "e38ec0ac-38ed-486f-bd73-bbc106ee6365", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776164373, "uuid": "550e3e18-4c30-4491-ab81-548e3e42dca2", "value": "TT COPY 008133904 AND STATEMENT OF ACCOUNT FOR APRIL_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1d66185-3843-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1776199855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199855, "uuid": "3707c09e-7dc2-4b07-8bee-7d22780a1e64", "comment": "Malware payload (ValleyRAT)", "value": "30f251b896956517a99d9675e0153078", "object_relation": "md5", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199855, "uuid": "98ad2f07-ec00-4c83-982c-b6e42dd5d072", "comment": "Malware payload (ValleyRAT)", "value": "e42418a96592473a22749b14e0472c8a145e24e538f1851f50e1e697c8d4fc46", "object_relation": "sha256", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199855, "uuid": "345ac89a-b3b8-4769-a7d2-5dcd6e46a96f", "comment": "Malware payload (ValleyRAT)", "value": "6056feb12d39a63023d093896c924a92aa529345", "object_relation": "sha1", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776199855, "uuid": "dd58deab-887b-4e18-be1a-4aee4bd6b214", "comment": "Malware payload (ValleyRAT)", "value": "64d765b3a7afe2bd9659b302c70b90db8c3557524b4a2f33ec2af0bc763cc43e8f4f10d5ed4a5f41be11589c3f306c39", "object_relation": "sha3-384", "Tag": [ { "name": "137-220-140-38", "colour": "#77A64F", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "uulai789-com", "colour": "#CE9182", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199855, "uuid": "8d91f7bf-3ce3-483d-a5f4-ca20048c15e8", "value": "T1CE546B65E3E31CFFF8A3B1344859864199B6F40343B0C67EFF6043299E13659992AB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199855, "uuid": "309dda25-96b2-453e-9caf-5b8c82c0415f", "value": "08e7a7a545245c46c9640166cab94d3e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199855, "uuid": "ab29ba25-d411-4779-8cc0-b266c165d778", "value": "6144:/Ve8RDKLJDx1Y9wpe8oFsQ59FoEQSczsSojTr:gWDKtDrYSYFJKEQyjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776199855, "uuid": "dbc2e52e-21d4-4957-a2cd-4b7db58dafb7", "value": 304771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776199855, "uuid": "886d1e4c-90a8-4cc0-bcf5-8cb514d03966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776199855, "uuid": "03fbe843-8163-41e0-9b55-e7cfb9bbedbb", "value": "HiddenLoaders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3e2bf3-382f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776191173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191173, "uuid": "2aa61c42-6d76-4936-96a8-9ffd9db58cc8", "comment": "Malware payload", "value": "a129784c46e29132dcdf809ed46e8ae9", "object_relation": "md5", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191173, "uuid": "a4dbcaab-d7e3-47c3-87b9-3b0272555fb8", "comment": "Malware payload", "value": "e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468", "object_relation": "sha256", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191173, "uuid": "93431171-581a-483d-a950-71208472a947", "comment": "Malware payload", "value": "879727bcf444ea9c02da9f1d9980bfa76c95bfb0", "object_relation": "sha1", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776191173, "uuid": "48a6bee1-e08b-48e8-9cae-340b738467ff", "comment": "Malware payload", "value": "12f5d1cdd3dba1906bea79b7ad78262bfb733482ded1a5463bf0e367e0b528d2742fc73939de8f49ddb593addeeab15f", "object_relation": "sha3-384", "Tag": [ { "name": "195-177-94-94", "colour": "#50AF60", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191173, "uuid": "0f9b963e-e139-455a-8b3b-fa8739051caf", "value": "T16681C72BACCBAE549D01641461ECCCC8F3D951D3641550AF3E29DC8F8FDAADBA4B305A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191173, "uuid": "e5251522-39f4-4202-a457-be031ece5845", "value": "96:Lq76mYiGgwvMD2STyNcpxbokpezEbaLTArly5vHp7kEvm:eDj5wvKTkcpxbFpezEbanArly5Pp7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776191173, "uuid": "8ad3ceb3-eab1-49a5-a098-cff10ed48f25", "value": 4024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776191173, "uuid": "4580751d-2c89-4ea0-bf27-65c18a366bd4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776191173, "uuid": "c34227d3-523d-4c06-883b-c38bc54baaa5", "value": "e49192673cef8408ccb035343697a6109fd2cc128f2818744b1dffb72b846468.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c171719e-37df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776156958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156958, "uuid": "849ef24c-8358-4417-aaef-3f6db05e62f3", "comment": "Malware payload", "value": "db476ded1937c1e7275387972b3e2cf6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156958, "uuid": "0432c612-76e9-4ef5-a11b-8652b6f19b81", "comment": "Malware payload", "value": "e56e17a5499d10f1a3414408c15c2fa5c63d5601a6f6b66810e9e4887296bc29", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156958, "uuid": "04c8d79b-94d2-47ed-969c-4db53ee27aa6", "comment": "Malware payload", "value": "ff93d1e09bcb8097b98beb0e33974e18d145a9ed", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776156958, "uuid": "ee5b9ee6-1ee9-4b76-a161-840a27536940", "comment": "Malware payload", "value": "de4359da1b22ab966f44d0b67f20c398464e357f5dd35986f31d1132fe88308bde4122deaa4a40364341217dee349347", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156958, "uuid": "18e59b61-2323-4985-8f88-b883b374399a", "value": "T163045A63B75AE35D05552F8F6B2B3B5094B0C0DF701F4AC027EA1EEBB58D8A60BC5261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156958, "uuid": "ba5c8619-fbe6-4f6c-aa44-08441cbcb474", "value": "3072:8Z+qUFx+gP2JI3fKHZlc9JCPuJvp1a8ie86NEeO0nq:8Zqx+gP2KS5Lf8ie8NeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776156958, "uuid": "c880e2ad-84b7-414b-87fa-7db921609ff6", "value": 184780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776156958, "uuid": "7685cf01-3021-4273-b340-8aa98b9eaff8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776156958, "uuid": "e86dab56-c1ab-420a-ac41-2fd09ac2c3b0", "value": "_Norman_RDLL32_EXP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e09e28-37d5-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776152568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152568, "uuid": "df8da76d-680e-4740-b86b-3817ea37557f", "comment": "Malware payload (QuasarRAT)", "value": "0e85287d065faf06980cfc74494ada92", "object_relation": "md5", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152568, "uuid": "dda5f9d7-7963-4f11-8aa3-d525a51a84aa", "comment": "Malware payload (QuasarRAT)", "value": "e647d4b39860c00a49582b85d71507c556c23f618deaf6b5674326c665c12d6d", "object_relation": "sha256", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152568, "uuid": "dc7f3362-0806-435e-8a25-a0275d64b492", "comment": "Malware payload (QuasarRAT)", "value": "ab7b5ec49184cf782a1b88a06f56d6b44bb82917", "object_relation": "sha1", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776152568, "uuid": "a975dbdf-b0de-46be-ae80-fda472470a75", "comment": "Malware payload (QuasarRAT)", "value": "636c3835f83bd4ff22d7b3cdc81edbf18a2012f87f1a25ff2293ace6f5f64576a54c7115ead1a75df2a9c1fecc8a216f", "object_relation": "sha3-384", "Tag": [ { "name": "github-com--demarcusnofatherington420-a11y", "colour": "#D740C8", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152568, "uuid": "15e00bb5-44e2-43a4-a101-3bf12d8a885c", "value": "T19CD5337884711C667E82ECFE345B9285EB05084F898075448E77F77A26DF18E6DABC8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152568, "uuid": "11808fb6-ae2a-4969-9d96-f27678a30a2c", "value": "49152:65t9xsq6eKOfrxmrdI8CY8eJ+60+pHiFPg99VPLmINtr1eEfD963azXZG:6f9x19K6xmG8CQJxJWP2bPLmUveEfx6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776152568, "uuid": "a335a1d2-5a59-4b49-b8e7-c0d6ed828848", "value": 2754357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776152568, "uuid": "2b1aba76-1880-40bc-91bf-8b5c8a3c5d23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776152568, "uuid": "be33bd0d-4476-4dfd-8f13-3826e3a75ac8", "value": "ScriptInstaller-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a29d12c-37e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776157617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157617, "uuid": "7885ee72-3942-47bd-8edc-ecf3e77b3b78", "comment": "Malware payload", "value": "8d60659ac7a57d55866364da8eddf024", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157617, "uuid": "6d0a2b18-3041-4cef-bef2-9fb379c8d2de", "comment": "Malware payload", "value": "e65523700005c9b9d128f28d3b93b23281bdee3dc65d547b703b1942e22f7715", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157617, "uuid": "79bceb9b-f568-4dcf-911f-ca6801a147c6", "comment": "Malware payload", "value": "f17bfa82ff7abf70d0abfe5cea5cb5676d91ea98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776157617, "uuid": "c48127ee-bcfb-4622-8deb-7f18e047a07e", "comment": "Malware payload", "value": "fc1398896995ab0c7286b462f93d2fff6c38275b8afb83a5c8307ffef780b5551fcbfd82f11983961660f76111bec028", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157617, "uuid": "76cf2c02-0f8d-48a9-a6bf-b1b6d7275317", "value": "T1A3B69D03E89104A9C5A9E230C9B79253BB717C495B3237D72B90F7786F76BC06AB9740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157617, "uuid": "af8a157a-984f-4604-99ba-433c7300eb7c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157617, "uuid": "a41f96bb-decd-4a6f-8166-754ca08b9aa8", "value": "98304:CNsfqmUFkHd+LV6Tjulb9Dk6WELGEN7xfMKDMQ0sKOkxpEQ0sWcEIewT:CNVmUk98AixTHBxMKDMZHbzPEIewT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776157617, "uuid": "ca7fc26e-4f71-4963-b50c-fce6388580fd", "value": 10691072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776157617, "uuid": "dca863e7-9187-4cc2-ae46-7233be87e128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776157617, "uuid": "93168431-1b8f-4886-8384-13dfe8eed0a7", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12041287-3805-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776172985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172985, "uuid": "1e175826-a394-40f1-8126-8e9946c9596e", "comment": "Malware payload (Amadey)", "value": "6f7e59eaa31a56b06f98f9e804e7b6ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172985, "uuid": "e348d65d-cd73-41f4-a167-de7ccb76daa5", "comment": "Malware payload (Amadey)", "value": "e6d6e4467919d58c63962af6d28f307f41e21690fd62931135662f4661fb6fd5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172985, "uuid": "2003e37f-f4c2-4c09-b2a3-ec0f4e9bdf56", "comment": "Malware payload (Amadey)", "value": "718d64a3d3ba31838ea5f25f191e96a8df202c6c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172985, "uuid": "df473750-8ba4-45f2-80c7-b89579476e4b", "comment": "Malware payload (Amadey)", "value": "e9e71e472be64726f297a1bc38650d4552413ddbada2b6cf484e7eee765edfeb0b8c08f9316eca59b7a1027f72a499cd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred.dll", "colour": "#7D438E", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172985, "uuid": "f96afdf8-47e0-4c6b-9992-2b083d09dc3b", "value": "T14A359D16B941C071D49401706269BBF2593CAA35672145DBFBD02EB2ED305F3BE3AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172985, "uuid": "ae6050dd-ccfd-45a1-8c3d-9278d13c3546", "value": "a252cd53ebc44617e8418747345d10c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172985, "uuid": "f11e081f-fa52-45b6-833a-f30220d12cd1", "value": "24576:ULCrua2InCFeiwzFJEUoBmx4I1bzNEhzcJZ85:U+ruaRnC0iwzFgI4oJZ85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172985, "uuid": "8fb93aac-f730-4a3b-8367-c62f9b0d4832", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172985, "uuid": "fccbbac8-a40c-4ca8-b897-243acfd8c0b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172985, "uuid": "23649de4-c21c-4217-a402-8df7b41137e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a64b2a7-3838-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776194984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194984, "uuid": "fd0a54aa-7bd0-4d64-9501-6fda13071ce6", "comment": "Malware payload (Mirai)", "value": "3878ab95f97a2dcf296194964df34030", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194984, "uuid": "ba401e85-d8d9-41bf-b5e3-a1aaefc1df87", "comment": "Malware payload (Mirai)", "value": "e82a8ac73095bf9e27611884d40a7f96af52bf954c9a325a10f21dfbb47223c3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194984, "uuid": "dbc1508c-3078-4d74-a0c6-32819ba3a666", "comment": "Malware payload (Mirai)", "value": "c7b9d6baa419338336abb36f187160fd403819b2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194984, "uuid": "5d473797-3455-4e45-876a-3232f1d08066", "comment": "Malware payload (Mirai)", "value": "f44279fbe70041d72eb88c062488cee25e002ac647ffc45dc9fd031c6abfcc0241273edf09595b53fbef0fa1fa20ac7d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194984, "uuid": "fa91601d-ade6-448b-a4b1-c0238b127837", "value": "T1C25193C81372BB397C62643271E7851871A9B09176C32E16BEE878E6C48CD06639DE73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194984, "uuid": "f4dce485-9fed-442f-bc7d-a2b90561811d", "value": "48:HtBPk7P2G2TGxy8LwL3iiiPwUFlSm78R/:HtNk7Px26xyGiSLIKtwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776194984, "uuid": "b413e7b2-89e3-4864-9897-79b6becba64d", "value": 2698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776194984, "uuid": "5e7b5772-a1d7-49ce-8bf3-da7a5fd713ad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194984, "uuid": "fa12072a-f9b7-4c67-af25-356cdc7de796", "value": "femboy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be411d9-37f2-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776165029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165029, "uuid": "7fd49c44-e121-4de7-a062-bae82bdd5f39", "comment": "Malware payload (PureHVNC)", "value": "3584efd1753b587c784e424032db7fe7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165029, "uuid": "e5705ed9-52e0-43a2-9791-774e56aa547d", "comment": "Malware payload (PureHVNC)", "value": "e85bf177349f91d23697920f51bc38fa2088d135d206cac70c1111dc79183cc4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165029, "uuid": "339653ce-f981-4088-bf51-0c07e5469a6b", "comment": "Malware payload (PureHVNC)", "value": "049cd4f8f6ac2e88bca0b85d2b3bf82c12e87d91", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776165029, "uuid": "d2ffa264-4a23-4b29-8138-67359cdfe7cd", "comment": "Malware payload (PureHVNC)", "value": "72859e787129658e1cb744a720e6eacabb85845be85b8a85dd00e98f8863ffca5a2687ff64ae78655c18394b6f54764a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165029, "uuid": "44354fdf-0b5b-49b3-8652-95f746b68136", "value": "T19A642038AAFA001AB173EF54AEE47497D96FB7733B0E585C1081038A4723949EDD563E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165029, "uuid": "4df94405-31f6-4434-aacb-2ec7afeae660", "value": "6144:VfBx+njq7Otiqv9Rz/ZDhKKbcMCfpDzRaoyLsKT/sGKGFEzjHe:VfB8O7OtiE9RBhKKbe3ly6GK8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776165029, "uuid": "e775e5d6-f404-4dae-871a-b2f6303ab9c1", "value": 312224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776165029, "uuid": "6e0e8471-ef22-4f25-929f-2c2a9b3d67c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776165029, "uuid": "d84aae1b-060f-4ae3-816c-2d649e7d7cad", "value": "SOA 753620980.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e171a541-3803-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776172474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172474, "uuid": "4b56b542-d32b-4fbc-8845-e2f9ef57ca42", "comment": "Malware payload", "value": "a3d3c5ab1dd1233239f55a5525efac1e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172474, "uuid": "4ef04a90-5f55-42c3-8b86-946e76ca5a26", "comment": "Malware payload", "value": "e86cc5a0cde3c8c06a54a03b5155099be836132269cfa458d5ee82165643674b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172474, "uuid": "01223370-e02b-4116-9c7c-3d5da9d37859", "comment": "Malware payload", "value": "a36e9da4283a8eb0be8821fdf2a5fd7559b7df60", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172474, "uuid": "f20ca560-ece2-49ed-8058-ce958717040b", "comment": "Malware payload", "value": "2f1f65fdbf2685d07e5bf0a7d57f30b4d4db4b7b37c74e8b55f84aeab79d6ad8a6aa62cb3673d2f4a57554fce3af30a0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172474, "uuid": "dcaeaa46-81f5-45c4-8ee6-cb12da33ef7b", "value": "T130137D6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C55A9CE318B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172474, "uuid": "a2db56d9-2a20-40e6-b132-513536d6ded5", "value": "768:bls9NyXsZztCe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:b6HusZecy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172474, "uuid": "de400bd4-d279-4368-9611-4e91033355d6", "value": 45511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172474, "uuid": "aee2a5b3-01ef-4e21-a802-437cd9393409", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172474, "uuid": "6e646349-ed40-429f-a9d2-c15a40c4f2e8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3cde489-3821-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776185255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185255, "uuid": "4a6cce49-e765-4eaf-8b4b-94590c569069", "comment": "Malware payload (Mirai)", "value": "e44894b44c5d0cfd07de311b2a651d6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185255, "uuid": "26ec27d4-6079-418d-8a1a-26cef08178cb", "comment": "Malware payload (Mirai)", "value": "e8e13c88a3eaa988b00c7c38a9fde31d3064c4f2e19e1cefc1d7306becfa51d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185255, "uuid": "2631e354-d0ed-4a8a-b026-db2d7d5c77bd", "comment": "Malware payload (Mirai)", "value": "af458d80d9845cb632f893532b2014610c7ed4b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185255, "uuid": "f37e9e5d-ba47-48bd-80c7-6ed8c6c5b661", "comment": "Malware payload (Mirai)", "value": "9b89a2a050ce1b09da9a5ea35784c9ddced5c9d79ffe856dce68c42451e320d06bd061044cb353a3ed6d1962e2c9f178", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185255, "uuid": "5cc1d87c-6cb0-45e2-a0fd-c0ed921323e0", "value": "T13F443A45EB408A13C5D627B9F6AF02463333A7A4D3EB730699246FB4378775E4E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185255, "uuid": "aae50f87-156e-410b-93ff-6ab2cf8da5de", "value": "6144:Hwge4HD8oLbjJarKVNfehY7170qiXC9MaV/GUOB:HLe4jtbjJarKVNfehYZIjO/9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185255, "uuid": "7bfefc59-766a-40cd-9c2a-ead1c3c3ef67", "value": 266563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185255, "uuid": "8d87f26f-c93b-4333-a35e-206878ec89ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185255, "uuid": "5f58ec5d-495a-4c2e-8134-c6d4dd5acbdc", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cfe7b7-3803-11f1-a769-42010a9c0008", "comment": "Malware payload (VENON)", "timestamp": 1776172300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172300, "uuid": "15e89615-5cc1-4c62-946b-53c8e3fae1b5", "comment": "Malware payload (VENON)", "value": "ec2536feb3f29cf9a00c5ca8de9a7eaa", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172300, "uuid": "c2af634d-6fde-4bdc-af98-469851e1377b", "comment": "Malware payload (VENON)", "value": "ea8f901364586b8fb6827e53a85564d53103b35d2e0109dacd3a6f713af89f5e", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172300, "uuid": "58690db9-3f10-436c-ac46-d8c63045f9f8", "comment": "Malware payload (VENON)", "value": "e61dccc160816c0b32ce6938b3999cf2e3ce3e4e", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172300, "uuid": "8992c9d6-c14f-4c4c-98bd-08f1a4a12a7f", "comment": "Malware payload (VENON)", "value": "e2195f15c1366f087ea6f70c637bf7de5011ab14128f0ab11f8e2cc92c1094bd0149aa133378745af506b8312a096add", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "photgridyelow-site", "colour": "#F94EDA", "exportable": true, "hide_tag": false }, { "name": "pre-planolocal-store", "colour": "#8D252C", "exportable": true, "hide_tag": false }, { "name": "VENON", "colour": "#088B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172300, "uuid": "ea5ef194-8f00-4c6d-9ab4-cbff7fee171f", "value": "T1CFB59D56B9501C2A28F827E0A9F21446D3CCC3F71B4DEBDDA0F54196349F38BE525AE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172300, "uuid": "6151993a-3cfa-44d4-af96-3cc25fbc31a3", "value": "24576:WZoLe7/PzzvZZEnRvSLS9IoghyOYM00Pah+UUUUdXHbIi7cDCCCCC3iiQDEw+UNW:AoLEonJsJhy2PLrFYuii0Ew+U7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172300, "uuid": "b9acc9a2-d3e0-49b9-9935-f56d98b8bec1", "value": 2300430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172300, "uuid": "40352614-9008-47d4-b943-27c24c583540", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172300, "uuid": "2a844782-662a-4166-9114-d5fb10570904", "value": "document_vBZcJo.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f995d7-37ce-11f1-a769-42010a9c0008", "comment": "Malware payload (SentinelStealer)", "timestamp": 1776149658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149658, "uuid": "608ebb93-2577-49f8-a25e-1958261dcffc", "comment": "Malware payload (SentinelStealer)", "value": "911e733a5d20feb6ec5ad740af7a5550", "object_relation": "md5", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149658, "uuid": "4bc8b70b-240f-4640-aec8-b6a9884ad1f8", "comment": "Malware payload (SentinelStealer)", "value": "eb14b5f6b8fc1e188cc2bba5d986a53f7b71182993de6e491e58c5437cfe6c3b", "object_relation": "sha256", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149658, "uuid": "58570754-9bd7-419f-8356-cc25db351b64", "comment": "Malware payload (SentinelStealer)", "value": "add3151d8696bc94ca13941c6eed8e492472a6f9", "object_relation": "sha1", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776149658, "uuid": "cdff337f-a33e-4b65-abc5-3616093600a9", "comment": "Malware payload (SentinelStealer)", "value": "6199d5867f258241e811fecc02e9b2fd68a9fa18283b41676e1bbbd0d4bc42e098919f8e60db2a2b10823891afc0dc15", "object_relation": "sha3-384", "Tag": [ { "name": "SentinelStealer", "colour": "#3032EC", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149658, "uuid": "3a631a20-1afb-4518-bc94-8d9b4dbc669c", "value": "T1223533334A2F1EDD1F6C1BA46018298A5EE199CB521CA7975665FCF76DBDF000CAD830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149658, "uuid": "f7fcce8e-f892-4a0c-81f7-1934babeef4d", "value": "24576:WWQYpAf+iBGQMTC3dw6JQ6H2HoT8gTZn3Mzz7ZvswnVB:WW7adlJSIYztB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776149658, "uuid": "943d3f81-9b08-4884-99c2-ee556a1dcbf0", "value": 1064595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776149658, "uuid": "b227dd7d-91cb-4d1d-9b89-f03dbd930f06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776149658, "uuid": "ef618353-b00f-410a-8028-7623a9b79c27", "value": "Provent_720_SALES-Promotion_rgz0w7.xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92abd3dc-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162463, "uuid": "73917fa4-995d-4820-a075-c8e1271468b1", "comment": "Malware payload (Tofsee)", "value": "8f88a1d6ef1b8e636c6271c3cf78f0ef", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162463, "uuid": "312dc420-c5bd-4e0a-a81d-81f2ac36fa61", "comment": "Malware payload (Tofsee)", "value": "ec21a7eb3f763990280dfa0be8634c36365d3b3b5a52933cd2dcf90038755aa2", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162463, "uuid": "222bf8df-251b-42d1-a893-a6284ec25409", "comment": "Malware payload (Tofsee)", "value": "fca73743ac48e48f7016e4178e44ca02514e329c", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162463, "uuid": "bf19eed3-e39a-40a9-9013-8a339dfe2c21", "comment": "Malware payload (Tofsee)", "value": "7f0eea784a01564c43cc6cb4504327351d4413002ca413242253deb062bb401a5cff02d94a524956b753ceb10e0fffa5", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162463, "uuid": "52c3bd52-03b1-456f-a32a-95a90302fa6d", "value": "T1DB737D63F5D19071E8820275F7A8FB169AFEDD35301DE48AEB020E415DA4DC2E72E647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162463, "uuid": "f0bb84b5-46c5-4be0-a749-f46838fd25f0", "value": "0bdef4d92a94790d7d279561a490c5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162463, "uuid": "0bb7a597-699f-4100-a234-5397aacce5b3", "value": "1536:H4P8s2aqCR2Tk660BpLZlHAGBJ9QQNd13dpIHagiUc:H4TqCR3660BpL/HAkTj1tpIHag1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162463, "uuid": "f2f1caf1-f066-4c61-a801-b286b76f3abd", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162463, "uuid": "5ba8330a-e7ca-4b68-a260-e99f08a0fe97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162463, "uuid": "912dba1f-d7a4-484d-a309-f43a653f192b", "value": "ec21a7eb3f763990280dfa0be8634c36365d3b3b5a52933cd2dcf90038755aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5ae6a3-384d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776203926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203926, "uuid": "83450f47-2b2b-48e5-9319-c255f1b74f76", "comment": "Malware payload", "value": "967d3848795f29a6877d2d7b2a69ceb8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203926, "uuid": "1ddc1b0a-7ed3-42db-a9b1-1b73b450ef09", "comment": "Malware payload", "value": "ecfa83c19ea59af4d8b472981f852a144f89aa8c4f6a7def2262a500f801d518", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203926, "uuid": "4a5bb3ea-bd6c-448d-9a0c-8d9784208a06", "comment": "Malware payload", "value": "072cc736efe7f6d043001ba1558547a20fc9da14", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776203926, "uuid": "ed8c9288-4a14-4ead-a078-267067b86de1", "comment": "Malware payload", "value": "04e9632f16c74ff8a288bdf2a66d373124bcaaa125a3f45749dd0311429705ac215f0b5267afe64e87f85d8af82f83ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203926, "uuid": "6ebb4ec2-fe86-4ced-94f9-89264a4b6647", "value": "T16D963341BAC080B2C97719750125AB29647859601E41FD2FAFD05E18BE336F3AF69BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203926, "uuid": "85f3e195-85e6-4dc8-83cd-bb81db3f9e09", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203926, "uuid": "bb75b261-0b11-4f99-9fe6-a2e56491efe2", "value": "196608:b+sfnRmt4uRlPGH+qCdUenGcXqc46DWNxTNvN1ZGkzp0jz5r:b+anRs4uruBe7bXr6NbvNGB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776203926, "uuid": "c46a8d01-4242-4b61-b479-f0742835524d", "value": 8856220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776203926, "uuid": "c1096268-8899-476d-bb74-1f5ca7711e99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776203926, "uuid": "23aa4835-cf09-4dc4-a3b1-fab590099350", "value": "GB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ded6dda-3836-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776194158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194158, "uuid": "40480075-3d92-4ca0-a3da-c36009b71ae7", "comment": "Malware payload (ConnectWise)", "value": "a40e6ca64bbeaf7e42100371defa2c51", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194158, "uuid": "7be3c286-d7f2-4f54-a576-3056861fabd6", "comment": "Malware payload (ConnectWise)", "value": "ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194158, "uuid": "e431173c-f114-44b2-9bf5-b37ae0b3d260", "comment": "Malware payload (ConnectWise)", "value": "98661a28d73703ec3728e8f9b25dfab043f4ca6f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194158, "uuid": "8cb0e31f-2f8f-4e7e-bb04-31bd7009fffc", "comment": "Malware payload (ConnectWise)", "value": "5dfd0741d45a938f6ba2c3b189d036ba5c9d9100d2cc6b52dca87db63031b2b11be7a993e4a57a44c98c7dd1637cd159", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194158, "uuid": "2cf438fb-96c5-41c2-86e8-b81a686f913b", "value": "T1AD51B8086903EB6DC0706789AA916A15D45F41BFD2302A1871FCDD085FB89341FFE6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194158, "uuid": "9830fdeb-7843-49cc-b7a0-16c243c3e798", "value": "48:LWbqvD+XSTqFjtt9P7FFbAoCj6Vvf4wIf2IXmPxaaH5SbM:LWbqvD+X1jttxF6o7gf2X0aog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776194158, "uuid": "cd6b4228-944e-44ec-b043-d1bd6b58ac4d", "value": 2497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776194158, "uuid": "66ff2928-54c9-401a-8958-fe5d0e7bf209", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194158, "uuid": "aea3802c-4fb5-4a58-adb4-45b56e15f86a", "value": "sysupdate.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4c0c03-383b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776196572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196572, "uuid": "a3fe65fe-0325-44e5-aeb9-827ceb65dd0a", "comment": "Malware payload", "value": "85eddfd3964ebac504fd5e425f72f748", "object_relation": "md5", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196572, "uuid": "e4959726-dca6-4d88-8605-31a5ebe10b42", "comment": "Malware payload", "value": "ee44921c71b4bfa3c33e5a2ed80c5f5d4aa4708b6b6feec9242f3192a8fa21bf", "object_relation": "sha256", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196572, "uuid": "aa6e6beb-0a97-49d4-a194-a2c554174e40", "comment": "Malware payload", "value": "5b9c5d3957d541d353cf1aa67d295086ac173f97", "object_relation": "sha1", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776196572, "uuid": "8f6592f7-003f-4bd5-a168-ba7899c410ad", "comment": "Malware payload", "value": "5846f7d76429b5b2bfbc5a5ecd5610f2908bb961dd79322dab169890a42198bd049950e8a3e3c95ecb5673ed0459d3b2", "object_relation": "sha3-384", "Tag": [ { "name": "antesdissovaidacerto-com-br", "colour": "#F48290", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "coyote", "colour": "#E09586", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196572, "uuid": "667dbf5b-eb77-4d8b-b95b-a68523783d86", "value": "T19005E42839EA9019F173EFB59BD479DADA6FB2733B03985D009103864723A81DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196572, "uuid": "84464431-505f-4280-8b0c-be0d0a4cf631", "value": "12288:zUIZdfrXg+JwuKt/S/605tARR7o0O0l7a9wlk9ENjvL5WQWEGkN5Q+XXjjSrAGi:zUIfw+Jwz/S/6vjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776196572, "uuid": "c2a4c49f-4978-4148-84c1-f8af9074fe22", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776196572, "uuid": "abd13452-3873-4ca8-abe4-768d7d7b4dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776196572, "uuid": "d1de87fc-08fb-4204-a012-d6d3f6a4df19", "value": "ee44921c71b4bfa3c33e5a2ed80c5f5d4aa4708b6b6feec9242f3192a8fa21bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4c1c72-380a-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1776175393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175393, "uuid": "f67cafc8-33b5-4fb2-be1a-61be69638f5a", "comment": "Malware payload (QuasarRAT)", "value": "b4cf2e0a86ec201ebe5428708a1d7dcb", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175393, "uuid": "2cff4c8e-d620-4fed-9732-a1b9245ab884", "comment": "Malware payload (QuasarRAT)", "value": "ee47323ef7a520b254b12a6ca6fbe0c5f3196618e183c083c0e6512252ac7f30", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175393, "uuid": "8c4c25f8-9257-423c-bdf4-2a4ac20dbf64", "comment": "Malware payload (QuasarRAT)", "value": "7fefd8dd1ed52015a21d02290162f7a8e00e6c29", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776175393, "uuid": "43cdd92a-48f4-4b99-a74d-fddbd07d0368", "comment": "Malware payload (QuasarRAT)", "value": "d95be9cdf8b71e207a2088c16de8ec739b4694ca407d63e5563c20093b883386937f7b8a9d1daf6ecfadda3ce8c561ae", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175393, "uuid": "17d585f8-93fe-4f9c-92ca-3366708d45c4", "value": "T1FB45331065D02E775FC0D6BF8048A983F67B8EA4A9540B0F8D572B4EB758C675EF8A30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175393, "uuid": "72950636-d6ab-4100-9df3-ef83f5b40265", "value": "24576:t5BoKFn9XQtKJSPoPFblqsaqTsspXwzJF4nr7yM:tncGKoPFx/bTs0XwzJ8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776175393, "uuid": "e18f1d45-930f-4a6c-a743-b748511bf574", "value": 1218596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776175393, "uuid": "ebb93486-71ec-43d3-8dd0-96ad836053da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776175393, "uuid": "5fa93ce3-944f-49ff-83c0-2b40e3f57557", "value": "aIg_173_55_2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f5bc01-37ec-11f1-a769-42010a9c0008", "comment": "Malware payload (Tofsee)", "timestamp": 1776162494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162494, "uuid": "c1b5e7d0-84dd-4908-8383-67ae73b7c8f4", "comment": "Malware payload (Tofsee)", "value": "4fa6cf203d86862df83a46f997b5bfbf", "object_relation": "md5", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162494, "uuid": "b7063361-c098-49bb-81b7-c9cc7090f4db", "comment": "Malware payload (Tofsee)", "value": "ee865ef3e06a9240f35f9340e46a84b38826e64da63e89a003c1c98406e3c209", "object_relation": "sha256", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162494, "uuid": "0788a8ef-e401-4f98-b165-0ea3bf4a61a1", "comment": "Malware payload (Tofsee)", "value": "184c2c4397a2014a3b15d097d74eb86fa9cd9188", "object_relation": "sha1", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776162494, "uuid": "3091b298-456c-4235-affd-d02c04ddde87", "comment": "Malware payload (Tofsee)", "value": "70fc8e99bb015e75de4e00efd726be69d8022da173b551ccbe695b79ecbf3a7449a98f6d0454ae75161f48551102790a", "object_relation": "sha3-384", "Tag": [ { "name": "94-232-41-96", "colour": "#A45F3F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "jotunheim-name", "colour": "#E84C78", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "vanaheim-cn", "colour": "#F93756", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162494, "uuid": "86a29793-aac6-41c6-99a4-563ffe2145e3", "value": "T1E4B6630981A90D83CEAAFD78768D0A1FCECD505FB04F770922D2F83AF566925DD1B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162494, "uuid": "dfc8759f-13f9-478c-88ab-0a08e280b49a", "value": "ec65e6f92ccc76ed34358795395fdcf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162494, "uuid": "03a1ef70-800e-4928-b618-d1ac01733da7", "value": "3072:8KPtaVfzJ+xzpxIUgpnvKxvGbqqV7gPCs5lQYFwGfABn/9vOsJp7tvFw3Lw3:VetWkUIy4bVyCs5ZQ/OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776162494, "uuid": "54dde641-bbd1-46bd-952a-7b17f0244f78", "value": 11248640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776162494, "uuid": "7ff05874-298c-4ad1-b962-45739f970be9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776162494, "uuid": "ccc6f1d6-d74b-4b1f-adb9-74cb5bdd5659", "value": "ee865ef3e06a9240f35f9340e46a84b38826e64da63e89a003c1c98406e3c209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3d730b-3821-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776185266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185266, "uuid": "de10c653-6045-476a-8839-779ad5b49650", "comment": "Malware payload (Mirai)", "value": "7a2a3e65788129820ecbe702b9c17aac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185266, "uuid": "df93e730-5f13-4c0b-bb5c-72d21a641f6a", "comment": "Malware payload (Mirai)", "value": "ef1d791e2c3e26ea5de95150cf7447eb6e9e155435458a20ec87c04e9ecbf557", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185266, "uuid": "e9b08a48-8299-4088-875e-1a39deab4ed4", "comment": "Malware payload (Mirai)", "value": "6cbca692bf513b7cf15789c6d685e81ea9dedbf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776185266, "uuid": "ebeee217-e3e8-42a7-a8d0-3f13f6992d1e", "comment": "Malware payload (Mirai)", "value": "80480bc59543550be680d2183e432518a97bd75e7eae27ecc93e67c3dfd12c6d645e14749487bad4169c9aeb660ba51d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185266, "uuid": "e06f241a-441d-493f-93f6-15074972a10e", "value": "T15634C61A6F228F7DF369873547B78A25975D33C627E1D685E16CC2101E2038E642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185266, "uuid": "68a53ef2-6378-4d41-a038-61029a638156", "value": "6144:ij98c4fR3mMXJc5TghvCigiPad32814eAs9VkjOZyrAYtTu1OILGrRgZO45LG3Jy:0AJzJJqALyfVlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776185266, "uuid": "6597934f-8be5-4f33-80d1-3dec52eccdc6", "value": 251040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776185266, "uuid": "ea4af904-91f5-4fc6-9982-66af840e67a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776185266, "uuid": "697d44b4-2344-4e57-b335-097a156f3077", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40cd08c1-3820-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776184660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184660, "uuid": "e98a0955-594f-4903-af43-79f18744d2fd", "comment": "Malware payload", "value": "6215f93a0885950f33ba643607633357", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184660, "uuid": "bab4b2be-29bb-43d1-af7a-df11a8f0b85a", "comment": "Malware payload", "value": "f0543ed0a0010acb8073ba95b07b48bd32483de86f907db48c98f0a435b25d65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184660, "uuid": "2fea711e-d556-4c06-af21-1300c83e8acd", "comment": "Malware payload", "value": "e2181364d618d9e4ccf46e7804cbfe28470e9944", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776184660, "uuid": "41ae00ec-123c-4564-acb6-00962cdafcd2", "comment": "Malware payload", "value": "bf5663843c65e570fcfd9e11bc42dfc0e51f906dcf7eccd9617b19bc36d116fcde35e820fe55d791adf196c9ef97736b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184660, "uuid": "a52bef92-1af0-4177-8816-61c8f3efaf32", "value": "T11A136D6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184660, "uuid": "d6c48bc0-983b-407f-a285-0cfa695888fb", "value": "768:bhXRWNGxVs9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:bblxHcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776184660, "uuid": "cde13edf-da45-4c99-81bd-58e944d9fad4", "value": 45519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776184660, "uuid": "c0417fd6-4ac8-4b0d-b78b-67864ff378e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776184660, "uuid": "ec80ef10-04c8-4fae-a838-ca620ff69ded", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a087be-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127194, "uuid": "9f3205f1-3558-420a-bef1-51a14cea7780", "comment": "Malware payload (Mirai)", "value": "84a5eddd3a4c51daabf2a43356783411", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127194, "uuid": "1973c279-53a3-4234-9ec7-24f1fbe712c7", "comment": "Malware payload (Mirai)", "value": "f1b7491c865a930e1cc298bf870438789351f74d0f11c6b2cc32063d7f75b00b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127194, "uuid": "f0eea380-d364-4b19-b20e-e774f41d79d9", "comment": "Malware payload (Mirai)", "value": "7b4a1e2dc41c95a1c276942d555770f841fd2486", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127194, "uuid": "059edf30-a5c2-4e80-9fbb-93f97f792136", "comment": "Malware payload (Mirai)", "value": "c839ce286d0dc54ac2c799e080a96b11a871ae423b2294d118b2a4059b790af6d47b5cadc0b3968aee8fb62c16a64190", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127194, "uuid": "aed97375-1606-40eb-9b42-1196dca2ec0f", "value": "T19AA3F886BD428B13C5D221F7BB9F028C371A57B9D6EB3142DD26AFA027564D70A3B250", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127194, "uuid": "9e346b35-e137-4c71-9c98-a4652fa0498e", "value": "1536:n18Fit3bXY3rxhZFhNJ8SpVfppWCclSF+aKOfhV7LPbOwMmFo6AZZdqOVzRSmycl:n8rG7GV/TMBX9ycZjpmOHXgtB6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127194, "uuid": "864f55b3-cd64-495d-a10c-d646f00cfdd7", "value": 102868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127194, "uuid": "35f04906-2526-4cab-9b4c-e9739e05c633", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127194, "uuid": "865724fd-c061-4757-afd2-20663a93252f", "value": "zyre.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4886f5-37c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776145383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776145383, "uuid": "9269c881-5ffd-4296-ae7e-f57b037604b9", "comment": "Malware payload", "value": "610fd2286f1563fcf84a14d523857a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776145383, "uuid": "53548d24-fe34-4688-82ae-9bfe4b166a26", "comment": "Malware payload", "value": "f496f576d76f5f0a2f22817833088efe86528a5bb8c013333b37e001db97c2c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776145383, "uuid": "320fd59b-fef5-49d4-8447-0dcf7f81e9d8", "comment": "Malware payload", "value": "6562bb4d796702ab63fd02912aa7c6311690d736", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776145383, "uuid": "c953d8ce-2e4c-4335-ad39-25895be220b7", "comment": "Malware payload", "value": "443f32137eda3f234e28bb53bf2e8cd8ee57c398553d2f6120583604ac63385e2bf26ffe8cab789135d0a5a2491fd507", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776145383, "uuid": "6208b2fa-47cd-47e9-8d76-306dc559f441", "value": "T1B7B4238FB7BE39C58DF12CE895F1CA1B8ADD1E9A18FEC9154CE6819C43D10139921F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776145383, "uuid": "2523d973-845c-483c-a213-d6c591e281e4", "value": "12288:VoJw13Esa1dWMz3omHXwxWvDQB1F2tt78NpI1jSvvkmlkT0teHA9:VoG13EsScEPHXMWvDa1kt78govVlkTu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776145383, "uuid": "85153705-6429-4b82-a346-8bb825f37467", "value": 516738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776145383, "uuid": "ddf49170-5df2-40ac-b734-94750c084c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776145383, "uuid": "b5932ddd-2271-4aaf-9706-827f00933b8b", "value": "pty10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f568e97-37fe-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776170215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170215, "uuid": "cac4d15d-d9cb-4fed-b5c4-5b8a2c834eb3", "comment": "Malware payload (PureHVNC)", "value": "8ddd9a0820452110b97f0e46e6afdac9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170215, "uuid": "9d060462-a13a-4891-bedf-4b14eaecb96e", "comment": "Malware payload (PureHVNC)", "value": "f6bf67e7a9d1a19dc1a1796686e786260ff619aca048624ae62628cbd5dc9985", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170215, "uuid": "beb7712d-ab62-4a2f-834e-43581707bf68", "comment": "Malware payload (PureHVNC)", "value": "c43c6603bdb63457163fb9fb84e4e7c773f86d8c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776170215, "uuid": "bd6cbda1-07c2-44a6-8c00-7e08e3e15349", "comment": "Malware payload (PureHVNC)", "value": "c4da7e661f49904c9a14d371b8d6af999af006f1e6f54b90cb3f6a0d77a5ce3c5a0996b56e02e85e2a071fc7e26cb012", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170215, "uuid": "8d7d5b22-bfff-4fb1-92a0-0d5f276ecb71", "value": "T11D450211C9C82FBDCEAC1A2894FE161EB3E0978A551A794EE7337D076FAB544120F0E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170215, "uuid": "c2e7371a-5a52-44fa-ba88-5ae92fec0034", "value": "24576:ybvNZ6IT/5C3WEt5GjukyROx15RW1xaKLDelbzT0H9opJs:yH6w/U3R0jucSgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776170215, "uuid": "92bae77d-b7d4-4d84-a37e-d25116bb47a5", "value": 1203469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776170215, "uuid": "dbe39b1a-b1e2-4b3a-afa9-96f983373a13", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776170215, "uuid": "0cb2863f-4397-4cc6-8876-a71b5be1921a", "value": "INQUIRY 2026-SP0006-B01.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458f91d9-3838-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776194976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194976, "uuid": "ae199417-f93a-400e-918d-c2a820368f7f", "comment": "Malware payload (Mirai)", "value": "601d53a8d4196bd301d7b35f06752ca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194976, "uuid": "0065bb3f-7d44-488a-b876-4de932ae908f", "comment": "Malware payload (Mirai)", "value": "f72c63b9bb8ea52c32c395d742a8f5d2428b230c18b87a4b7877e259344adc99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194976, "uuid": "1d5499ff-b281-4c5b-9b75-c9af37c29bc7", "comment": "Malware payload (Mirai)", "value": "3ee43572bb2daee4372f35c8fa772dff7f3a774b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776194976, "uuid": "feea92ca-6563-4290-9deb-7ae49a81142e", "comment": "Malware payload (Mirai)", "value": "c9fcf69b0ecfca0fdc2c6ebd1357e893ab0f942d5148e0221b55aff892b0dff9d5ca5ba96a4fb7fdf9a0ee265530faec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194976, "uuid": "4a32901a-3939-4e61-9b80-38bec956eac2", "value": "T1CDB3AE8BF68B1091C86246F017C75BDE2E2322118F2BD5F77C5D763E1A752EE1A0A781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194976, "uuid": "b075bb49-6518-4bf2-b5d8-cd916dce4bff", "value": "1536:Nhf63B37I+v9mwUhQjkEu4Nbux6/AB3Ug0/+/LWd:GRrI+lmVhQjU4NbYRUgK+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776194976, "uuid": "4b5485e7-2867-4ccb-bee6-60e671d1d289", "value": 108252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776194976, "uuid": "a2b234cf-e203-4a10-83d4-7bf54422df64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776194976, "uuid": "d5b64f2c-6ea6-4f0d-8793-869525e31583", "value": "bin.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcc3a4f-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127233, "uuid": "bf9e835f-be92-4d61-94d3-c9f9d492992a", "comment": "Malware payload (Mirai)", "value": "8874619ffab3094b21b191cf4bd46a6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127233, "uuid": "63cc78ab-dcf4-48dd-b49f-a1820534d1bd", "comment": "Malware payload (Mirai)", "value": "f88206a54e9b76e9d713971aa5a1f531a60b622cd29e9de7a5473d60f02efd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127233, "uuid": "f32bfba3-abea-4122-be5d-63acfe686c11", "comment": "Malware payload (Mirai)", "value": "9ed659b9db3444bb18781d52c9a0b84c660dbd5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127233, "uuid": "6aadc4e5-0a0a-4da7-a4e5-df5255a0d011", "comment": "Malware payload (Mirai)", "value": "b0b3e172053a552e813e609cc93a9d5d4737748c913eab3f7588b6bd8a32bb405b1dd39eed69c958536b9a69ab7c555d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127233, "uuid": "a536cdd5-f8c4-46b6-9295-6236f84e5108", "value": "T1FAA33927BE724E27C4C2A1F552F30731E5B1ABAE1C78851ABD612DC86F641D03256BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127233, "uuid": "ab816f11-b6f6-44ce-9627-b75b143d95d3", "value": "1536:VbFrpqUTxUtbd+D18eCNtaY9oD5st2Uzuq5EYY82YLs:HpqUTxcyOYEo9zUjSMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127233, "uuid": "7d02d72b-00e6-42e7-884e-99fc644852cf", "value": 103360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127233, "uuid": "b443e060-046c-493a-8427-69f4825447cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127233, "uuid": "760af75f-f435-463e-951e-330d157ad4f8", "value": "zyre.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418498bd-37c8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776146865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146865, "uuid": "128a58f6-210d-49a4-96fd-a798aa51d3ca", "comment": "Malware payload", "value": "ce4e55f98b6ce034aa2e97d6a50cb1b5", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146865, "uuid": "904a395f-637f-4a7e-8a10-9518347ec54c", "comment": "Malware payload", "value": "f94021cdf5ba701a2a36c73a87730b9bbb4cdec8a1c8179d096318118c686b42", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146865, "uuid": "ab40cd67-0706-4ef9-8d0d-f924be685f3e", "comment": "Malware payload", "value": "4e2b9a128da7f53cce220873cedda012de7320a8", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776146865, "uuid": "84a76fd0-306f-4f4f-94ac-445afcec0b0f", "comment": "Malware payload", "value": "802aa03be88b7debd0c6305c1c106dbc0998701bd218bee743d5d7a4105406fb1607a0f11e6c05cb7e51589a41b44501", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU.file", "colour": "#D46697", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146865, "uuid": "328f3a74-669f-4548-9fae-337df37c59d2", "value": "T1C9C58D0BBC9005F9D46A97318CB61295BB78BC490B3233D72EA0BA742F757E05E79784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146865, "uuid": "47ce7a48-c802-402e-8739-7012b667c7b0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146865, "uuid": "d6b0c5d6-3826-4ece-843c-0daeef912f46", "value": "24576:z+dmsVUX9a8ohQz6VLTb8UJ/GQDPAL0we8dtkz3+PZg7ZxXZuF366B6wPNNShhez:zxsKZoI6VLTPJ/yyz3HHZuF366BryL14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776146865, "uuid": "e4b8ee31-e96f-4bc5-9234-0aec5c3c2b8f", "value": 2673792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776146865, "uuid": "dc30c186-3486-424b-a68d-43de2ddfed77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776146865, "uuid": "66546cae-e812-42c9-9453-af5f64d30e9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e58bd80-37ef-11f1-a769-42010a9c0008", "comment": "Malware payload (PureHVNC)", "timestamp": 1776163530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163530, "uuid": "280f2b4b-5a11-47e3-b95f-9dba0cfcc5f4", "comment": "Malware payload (PureHVNC)", "value": "3094fcf5b2b5073d011496276857ecf9", "object_relation": "md5", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163530, "uuid": "64dded70-d122-417a-b2a9-fd52ce00849b", "comment": "Malware payload (PureHVNC)", "value": "fa5001018f58f4ff3ca038173b7a2fe2c1657ace0cab7c9e28fbf321bb85c019", "object_relation": "sha256", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163530, "uuid": "1663a813-ce8f-4072-9e5a-d5b4923e963c", "comment": "Malware payload (PureHVNC)", "value": "566b9b2cacd41e8efd55725902029f9e2eb9305d", "object_relation": "sha1", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163530, "uuid": "916bd8c3-4137-4310-94ec-986244fdbc10", "comment": "Malware payload (PureHVNC)", "value": "9ab6d89e969d04e9e9011da1fffbbb9acec2a75af2a5b12989d393c7fa01121219314891fb25fc0ad21f401c70f3fc6a", "object_relation": "sha3-384", "Tag": [ { "name": "118-107-40-167", "colour": "#A71277", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163530, "uuid": "32a8ca0b-1105-42b7-a9b3-735338c01539", "value": "T165C60233AE129D1FEF1D15D2EC562CC65DD8367B3294AEA8DEE9746900B1D6309E80CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163530, "uuid": "f0d75a03-8fa4-4dd4-a86f-b25920240173", "value": "49152:rN0qNnMETIK6lLgIb6dYZZQ4lNNswYFeyCTQTIEkGYE0hYOa/YZ/4oTDzL5UjRMX:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163530, "uuid": "fed07eb4-4fe2-4721-b16a-8a2c34974275", "value": 11849484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163530, "uuid": "dcd79ada-2950-4cdb-98b4-b1d83e9b296b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163530, "uuid": "8d1c4596-a94f-4ee4-9584-67c4566751d1", "value": "3094fcf5b2b5073d011496276857ecf9.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa19f7f-3811-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1776178234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178234, "uuid": "d9f725dd-c10e-426b-880c-642354e0b76d", "comment": "Malware payload (Stealc)", "value": "bed72d0f3df3bc2f29af241d591655cd", "object_relation": "md5", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178234, "uuid": "988011a5-ec99-4a35-b0d1-705f969d5a76", "comment": "Malware payload (Stealc)", "value": "fb176719a4819edb677357bdefdc2dd270330395b040933344b50ead500a6a7b", "object_relation": "sha256", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178234, "uuid": "e9737ffb-edc8-46d1-9553-c79c22770c79", "comment": "Malware payload (Stealc)", "value": "a58d6b787850e8aa71bb0ccf6471d7fb80921489", "object_relation": "sha1", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776178234, "uuid": "1426b093-9aab-4a3b-b180-53ebfb81a5d2", "comment": "Malware payload (Stealc)", "value": "3b73fc26f63f1322c0551230cc602b2be97fe693f2b549f76b130a32fb07dfa8058ace5dad0d16328f8aee6595d9944e", "object_relation": "sha3-384", "Tag": [ { "name": "95-85-238-4", "colour": "#563F4B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178234, "uuid": "f277cffb-bc5e-47f8-87ca-6adcf708b110", "value": "T160F615B83CCBB116ECBAC9319393ACC48E2EBA97361B7973415F4251EDA4894DD4740E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178234, "uuid": "ea743d10-c6f2-4f40-bd6d-48e23cd32fd1", "value": "8a3f5d7b1e1d64ff39089244653c4329", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178234, "uuid": "65bb98e7-a647-49ba-bde6-343d8355efb3", "value": "3072:g6zU/CpbXfOSx2fEZojlRjUBhjAhYfzeYd3d7O9QcOVPGynx+MkSWBR9+OpHDduQ:g60S32sq4BhjAhCBhOqcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776178234, "uuid": "94f9da83-bc7a-4ffb-bb6f-4c0b6e3c3b9e", "value": 16386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776178234, "uuid": "cbfd46c3-7b93-44cf-bbc6-9c7539c82477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776178234, "uuid": "05c5bce6-d399-475e-98ae-4f37add87cad", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7818814d-379a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776127200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127200, "uuid": "7bc991b8-5324-47e6-954d-dc43873062b9", "comment": "Malware payload (Mirai)", "value": "58c2ed4a958b00cca4f814fd3e49c49e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127200, "uuid": "87b04752-ab15-4f3f-96fd-8d811664ad44", "comment": "Malware payload (Mirai)", "value": "fbe8f279e4aebc772e4e6c57d13869bcd09aedb0e3dc5f723b5809888195afb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127200, "uuid": "37ca9a40-fe07-4870-8ab0-9d80961ba15b", "comment": "Malware payload (Mirai)", "value": "503eada3cae26eacc6afde9b55e25e1f2e86609b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776127200, "uuid": "310c9793-c94f-46f2-a691-ecbad6a7205f", "comment": "Malware payload (Mirai)", "value": "6c17fe2b5beaab0bc25bf6fe5503e3ee3d4842e7234281a2bba3ad8b36361701a76a99a34d912872ff67201b0456ef8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127200, "uuid": "0dad59ce-3ebf-4ec6-b0bb-f51eb5e3c7c6", "value": "T1E0C3C85B7E228F6EF22982714BF34E31965876D62BF18581E16CED401F202DE641FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127200, "uuid": "0ab72c5f-cf80-4ab2-ba71-4de913130fee", "value": "1536:cz/fPwvpPE3IpBZZIk8Joj5EcVZKxSv7hXURH6PvVmIeAb+53qBeb2Iatkp2lphK:czXPuPEUZ2kH7c6PvY3I+5l2T6bAS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776127200, "uuid": "1e1ac9d7-8bca-4e0b-973c-e556ba90b90e", "value": 120920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776127200, "uuid": "759d2009-2cbf-4677-b2e4-e01874c8dab1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776127200, "uuid": "61f2b5e7-c601-4d24-b403-f61de29f4231", "value": "zyre.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa0fdf0-3805-11f1-a769-42010a9c0008", "comment": "Malware payload (Amadey)", "timestamp": 1776172999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172999, "uuid": "5d48be60-768b-4649-a324-b4f79206e722", "comment": "Malware payload (Amadey)", "value": "b69d4ee762700b4a3f2189a2d46a1921", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172999, "uuid": "40e09bd7-0bdb-4dcd-a7b2-224f9fd95c78", "comment": "Malware payload (Amadey)", "value": "fd06ae3e73f328efef8e2589a126443f7ab5ef6fee8334cd938005f2b5c907b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172999, "uuid": "fe75bded-6f3a-4a2e-9c87-b5d9f9381bcd", "comment": "Malware payload (Amadey)", "value": "948d51fdacdd1ce78b27e4f7332e09f99c98607f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776172999, "uuid": "ec892c0d-9eda-4f8d-988e-08dc9d973f8a", "comment": "Malware payload (Amadey)", "value": "84c215a4f045e770ffef36065d8e8e89542ec041621dad45b333199491cc3023aced265c23d81c37f326ab1a2a0eb8c7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "cred64.dll", "colour": "#5203B8", "exportable": true, "hide_tag": false }, { "name": "d854e4", "colour": "#D214AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "plugin", "colour": "#FF1DD9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172999, "uuid": "a7a6066e-c5dc-4b82-bc6e-4d3e005177e4", "value": "T1C9557C0BA26141BCD4BBE1789A175A47F775704603709AEB07E446A63F13FE1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172999, "uuid": "9f1b0b05-4034-4659-b059-1e6091004cbf", "value": "3f175edea93fa7a76a78004d12de2235", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172999, "uuid": "6f1489cc-8614-45ce-86ad-4a6b103e64c2", "value": "24576:drR0NaOy0mK9yCksn6JCc2YkxfUyamitsDw+mLRZDOnW:dkHmiyCkhh2Bamituw+UXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776172999, "uuid": "96dc9996-2899-4c31-a562-7fa90c888f3b", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776172999, "uuid": "3f904a2e-f20b-4782-9a9d-a77cf10a139c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776172999, "uuid": "9634c157-9fc6-4ae2-9f12-077c43611adc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fc894b-3834-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1776193470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193470, "uuid": "fa4d9ace-8354-4e25-9492-51ef558d7025", "comment": "Malware payload (AgentTesla)", "value": "3bf26861517ae47d7e966c2fc4910366", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193470, "uuid": "da16e610-1db8-48a0-8913-726a237910ea", "comment": "Malware payload (AgentTesla)", "value": "fd090a601c7e1d2625b38b9da0585bf8e2030dcf5628e27de3d28124b596dfff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193470, "uuid": "cd71634c-2d12-4faf-a36b-00555584ea63", "comment": "Malware payload (AgentTesla)", "value": "bdcaaacd5935a7726891497237d70562db9d14be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776193470, "uuid": "148f6826-e73e-4745-a75d-8a2435309b15", "comment": "Malware payload (AgentTesla)", "value": "1a444591f46c41991e5a313d5f41a5b5dfca156febcc4d280ed26de6d8ae8dad4c43c4068d618edf9d3bb7e1358925b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193470, "uuid": "eec5e493-8847-4cca-b54a-2a341b228412", "value": "T1476502154AC43FE9CFAC6A1D90FE251FA3F0098E515A7589FB23BC4BAFB7A005117498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193470, "uuid": "0f92c273-f1c5-4ad1-8d20-3f765cdde386", "value": "24576:YxI3rORkxBtinp5r26PauHJZAG1Mc9EobNmgn9gAdu:Dgn/McaobXnij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776193470, "uuid": "2d235b34-0706-4cf9-b946-54e8d7d32634", "value": 1466212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776193470, "uuid": "b625a421-e13f-41a9-bbc2-73902b152808", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776193470, "uuid": "9c1ceaea-4f74-4a65-8931-827d4e963616", "value": "Cotizacion_247_20260_Pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52de362-37a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1776130389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130389, "uuid": "b6d1f131-43e7-49db-bc34-b9b7cd6d9f26", "comment": "Malware payload (Mirai)", "value": "6eab591711c8ce38a7c0dfbbcc6a0944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130389, "uuid": "2de0ebea-35b9-4c21-83e2-b237cd996ae2", "comment": "Malware payload (Mirai)", "value": "fde63daeacf9c0c8d2b13c70666e4a9b9245a348a9906e92ba822fe4afff870c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130389, "uuid": "3e9644c9-cc76-4f69-8381-cad7f3c3fe64", "comment": "Malware payload (Mirai)", "value": "16b8a775e1afe2c0c7ec0bd3c65b722f158643ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776130389, "uuid": "0859c09a-f94c-4e8e-9bc7-25be30bd6b44", "comment": "Malware payload (Mirai)", "value": "cc1df253c8828eec5199b7a8b8b502e9c345f40ee3d66a92b824b4b1e3cd92b7c3ec86b1d4720602e5f8f64657f43e4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130389, "uuid": "431ade46-5161-4548-a920-c8ac7ec8e522", "value": "T141037DBAC4296DD4C5194274A8358A7C2F63E110D3833FFB5A4585A68047EFCFA0A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130389, "uuid": "7d3505c4-8a53-4485-be2f-5507b0f1ea44", "value": "768:MaFf2wtYwNSKvPnveeddMi0EN+DwrMCvofi3SCqv:Ma12wtDVzOw7M/fkSCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776130389, "uuid": "99e423a3-c796-4347-9a01-54a466054b6b", "value": 39204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776130389, "uuid": "e1fe4aa4-92a4-4c6f-b6eb-e422bdad43c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776130389, "uuid": "9292d73e-94cf-4d45-91fe-eaf7c1ba4b4e", "value": "0upsh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ba4743b-37f7-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1776167095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167095, "uuid": "c5469970-df00-4d51-b871-a35ebb70b5aa", "comment": "Malware payload (Formbook)", "value": "4554691fdfd03772bcef0a854c279cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167095, "uuid": "81302fb4-6c60-4c35-9e96-34930f2fc697", "comment": "Malware payload (Formbook)", "value": "fde78edfa6163f53cba50d7c8214b078dfb569fff8f97f25e063decbb7370787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167095, "uuid": "ea4799cf-3354-4ce4-b94a-0a2fc6ddfd5c", "comment": "Malware payload (Formbook)", "value": "d57d3fd567d72661f9db2d1ac79dd8fc979e4208", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776167095, "uuid": "c5d19826-65d5-453a-bc2d-8f4bb5ce538f", "comment": "Malware payload (Formbook)", "value": "d8f595056c6069ba2f86b56f81589e83e5d5408588350386498b67f135ea8a1277d654884516198b5e1df7ba84e51e92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167095, "uuid": "0f72d61b-028b-4b7a-9f19-5cdbb87af011", "value": "T155351225A25FC803DA469B7508E5E03127745ECCE122C5979FC97FEFB43AB64478A30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167095, "uuid": "d771a26e-002a-4fc2-a1ea-38009257c2c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167095, "uuid": "e597dad7-12fb-4a02-b409-8a9d90979d11", "value": "24576:/Fq+ZSilsyNFxu5hV1wa3nIwTh8FN46NiahbrszDKFWKX:/d1ls4FxChoa4eh8FN4BsbrsGWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776167095, "uuid": "13ef210b-2da6-4ab6-8af4-a61a454ecfdf", "value": 1115136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776167095, "uuid": "da531e54-c1d3-4a1b-a672-2a0e30290d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776167095, "uuid": "fd8e6721-58c7-49be-8af8-89969d9b5825", "value": "Quote Request.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb86054d-382a-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1776189268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189268, "uuid": "51042359-fddf-47d8-8092-e342aa28dabe", "comment": "Malware payload (ConnectWise)", "value": "79856089b1b30b460cec56d3e5dff0c0", "object_relation": "md5", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189268, "uuid": "31081cbe-94ba-4f3a-ba88-32dd6934edb8", "comment": "Malware payload (ConnectWise)", "value": "fdece6e442913977811c53fec2b463d265dc49f107504389fc442bb44eddb3b5", "object_relation": "sha256", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189268, "uuid": "90d558ad-c74c-4172-8c44-589b47fc253c", "comment": "Malware payload (ConnectWise)", "value": "5056394c287c572d9c3e10498531ea1685bbf2a3", "object_relation": "sha1", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776189268, "uuid": "c4d9c0ba-b5cf-47d1-a16e-ced274e11211", "comment": "Malware payload (ConnectWise)", "value": "2deeea61f5404f80c5efb86bbad18edc8bfe9b44aadb48e9eeb4955102200339fa1f4b943934dc8bdce94f0c87d2faab", "object_relation": "sha3-384", "Tag": [ { "name": "184-174-20-150", "colour": "#864D94", "exportable": true, "hide_tag": false }, { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "willbeanfeddeals-shop", "colour": "#A4EE40", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189268, "uuid": "64f704b4-030a-458c-8217-b591753bb9c2", "value": "T1E221320FF70FE2202AA59323C3AA1D1DCF48026B47008892BBA875089F20734DB781D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189268, "uuid": "f0228bbb-80a0-40c4-9d30-caaae35aa6b6", "value": "24:Pb7z/Gc+YDLUd0s3MdK6KJevZROMaARkIIMPTQ/FdW2AwU/G:j/1DL48I6KJevZHREMc/FdW2AXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776189268, "uuid": "5e17b407-1619-42dd-81aa-4641c327d4fb", "value": 1238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776189268, "uuid": "ee9a5b71-aebd-48d1-86e3-61a5cb39f4ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776189268, "uuid": "89d06aeb-e29d-48ac-b1ce-c63b10817104", "value": "welcome.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060c9277-37f0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1776163945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163945, "uuid": "1643b2c6-42a0-487d-abf1-410964ec11e0", "comment": "Malware payload", "value": "33c087a00eee5314165be10f093331e1", "object_relation": "md5", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163945, "uuid": "e21febe4-67cb-40a3-955f-0a77de3cdbe5", "comment": "Malware payload", "value": "ff20d2da3da2db84fe20f162c51f54d53719a31c2a5f91f416641c6f014b1924", "object_relation": "sha256", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163945, "uuid": "f2ac6754-d02a-47e8-8b19-d4152673d125", "comment": "Malware payload", "value": "d8eee5ef48ead516d49391e6e3b83b1d4f1d4030", "object_relation": "sha1", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1776163945, "uuid": "fa8dd77b-9958-419d-a831-10387d05728b", "comment": "Malware payload", "value": "ad72eaf49932c3c04a3a6f6eae01abffc1bea9f30624c6728cbc4added63ad8ddb7116b98de344610ba6e4ae2004b6a4", "object_relation": "sha3-384", "Tag": [ { "name": "BlockCerts-Blockchain-Canada-Inc", "colour": "#232C2F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163945, "uuid": "c090c3fb-db2d-41a6-aa89-fb68bf939aa5", "value": "T13DA36B5074D18476D9BE293414B0DA61AB3E7950DFE0DDEB239906BE4F303C0AF35A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163945, "uuid": "7822bb9b-5583-482d-b24c-25dd898ae3c8", "value": "c49b514c93b623070259ba17feb8937b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163945, "uuid": "89c13751-81bc-4521-b638-cb5f15e64180", "value": "1536:fukDVFzWiMJdJsOmPMGy9PqzANopgafnb75PyFu0F8ogsWncdwHSFk8mKZ372JHL:fRzzYj+G9PRKgafn5ygjSwHSK8mKZ3qr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1776163945, "uuid": "a921c22b-39ef-414b-8fdd-a81f727769c4", "value": 98400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1776163945, "uuid": "f378a823-fcb0-42b5-9f66-c85b61384bf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1776163945, "uuid": "f34bf3d4-432f-4eb4-9959-76c753606dd8", "value": "ff20d2da3da2db84fe20f162c51f54d53719a31c2a5f91f416641c6f014b1924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }